ISP routing for different Vlan

[Tabish Hussain]

I have a design where device connected as: SonicWall firewall 2700>L3 Core Switch>L2 Access Switch.

I want to make few VLAN on L3 switch and also apply ACL and do IP routing in it . But I have only one uplink between core SW and Firewall and I don't know how to make 2 different ISP routing for different VLAN on FW because I have a query, should I make VLAN also in FW, if Yes? Then on which device will be my gateway for different VLAN(will it be on l3 switch or FW).

[Flavio Miranda]

Hi

 If you firewall supports interface vlan with do1q encapsulation you create a routing i n a stick topology.  Each subinterface will be the gateway for each vlan.

[paul driver]

Hello
Have the L3 SVIs on the core switch
The connection between the core switch and the firewall can be a routed port running and run an  IGP such as ospf so to advertise the cores switch vlans to the fw and to advertise a default route into the core switch

On the FW assuming you are static routing to the ISPs , you could have a default route pointing to ISP1 which means by default all egress traffic will traverse ISP1, you can then policy route any vlan traffic you wish to egress via ISP2.

[M02@rt37]

Hello @Tabish Hussain,

--Configure VLANs on the L3 Core Switch: Create the VLANs on the L3 core switch and assign the appropriate interfaces to each VLAN. Configure the VLAN interfaces with IP addresses for inter-VLAN routing.

--Configure Trunk Port on Core Switch: Configure the link between the core switch and the firewall as a trunk port to carry multiple VLANs. Enable 802.1Q VLAN tagging on the trunk port.

--Configure Subinterfaces on the Firewall: On the firewall, create subinterfaces for each VLAN and assign them to the corresponding VLAN IDs. Each subinterface will represent a different VLAN.

--Configure ISP Routing on the Firewall: Configure the appropriate routing on the firewall for each VLAN/subinterface. You can specify different default gateways or static routes to direct traffic to different ISPs based on the VLAN/subinterface.

--Configure Firewall Rules on the Firewall: Set up firewall rules on the firewall to control traffic between VLANs, enforce security policies, and allow or restrict traffic between the VLANs and the internet.

--Configure Default Gateways on Devices: Set the VLAN interface IP addresses on the firewall as the default gateways for devices within each VLAN.

By using VLAN tagging and subinterfaces on the firewall, you can separate traffic from different VLANs and direct it to the appropriate ISP or apply different routing configurations as needed.

[Richard Burts]

I am somewhat puzzled. The diagram shows the firewall as ASA, but the verbal description says SonicWall. Which should I believe?

But aside from that aspect I believe that the question is fairly straightforward. The diagram shows 2 inside vlans/networks connected to L3 switch and a connection from the L3 switch to the firewall. The original post indicates a desire to do inter vlan routing on the switch and I believe this is very appropriate. I see no benefit in trying to have the firewall do routing between the inside networks.

So the switch will need a network for its connection to the firewall (perhaps might be the management vlan mentioned in the diagram or might be a new network). The switch will do routing between the connected Inside networks and have a default route with the firewall as the next hop.

The firewall will need routing logic to reach the inside networks with the L3 switch as the next hop. It will need routing logic to determine which inside network goes to which ISP (and logic to determine whether there is any failover if the connection to one ISP has a problem).