VLAN on Firewall and VLAN on Switch

[feruqhshariff]

Hello Can Someone Please help me in understanding the VLAN's configured in Firewall and VLAN's configured on Switch.

For Example- VLAN on sophos or any firewall device and VLAN configured on manageable switch's.

[Georg Pauwen]

Hello,

what are you after exactly ? Vlans on firewalls (e.g. Sophos) and switches are conceptually the same, that is, they are logical entities tied to physical ports, for the purpose of network separation. The layer 3 configuration of the Vlan is taking place on a Vlan interface (SVI), not on a physical port, that is true for firewalls and switches alike...

[feruqhshariff]

I am not so happy with this, Need some more good technical points.

Suppose i configure vlan on any firewall device what will be the outcome.

and Suppose i configure vlan on any layer3 switches what will be the outcome.

Example:-  I want 3 vlan3 with each having 15 ports.

so what should i consider vlan configuration in firewall or vlan configuration on layer switch3

[Richard Burts]

It is not clear to me what you are looking for. To answer your questions it is pretty much the same answer for creating vlans on firewall or on switch (the mechanics of how to do it may be slightly different but the processes and the outcomes are equivalent):

- if you create a vlan you have created a layer 2 entity for the vlan.

- you can assign ports/interfaces to the vlan.

- if you configure a vlan interface you have created a layer 3 entity for the vlan and you can configure an IP address and other layer 3 functions for the vlan.

- if ip routing is enabled (the default for firewall and possible for many switches) then the firewall/switch can route between vlans. If ip routing is not enabled then the device will do layer 2 forwarding for user traffic and can use the configured IP address for management purposes (allow remote management, send log files, participate in SNMP, etc)

So if you want 3 vlans with 15 ports in each vlan (which sound much more like a switch than it does like a firewall) you would use steps something like this:

- configure vlan 2

- configure a name for vlan 2

- configure interfaces 1 through 15 as access ports in vlan 2

- any device connected to an access port in vlan 2 will be able to communicate with any other device connected to an access port in vlan 2.

- configure interface vlan 2

- configure an appropriate IP address and mask for the interface

- configure vlan 3

- configure a name for vlan 3

- configure interfaces 16 through 30 as access ports in vlan 3

- any device connected to an access port in vlan 3 will be able to communicate with any other device connected to an access port in vlan 3.

- configure interface vlan 3

- configure an appropriate IP address and mask for the interface

- configure vlan 4

- configure a name for vlan 4

- configure interfaces 31 through 45 as access ports in vlan 4

- any device connected to an access port in vlan 4 will be able to communicate with any other device connected to an access port in vlan 4.

- configure interface vlan 4

- configure an appropriate IP address and mask for the interface

- if you want to route between vlans configure ip routing. Now any device in vlans 2, 3, or 4 configured with an appropriate IP address, mask, and gateway can communicate with any other device in vlans 2, 3, or 4 configured with an appropriate IP address, mask, and gateway.

- if you want to route traffic from these vlans to outside then configure a static default route with appropriate next hop.

[pdenableetoavit19698]

Hi there @Richard Burts 

Thanks for clarification, I am on the same "questioning" .

My point would be if you have the option of creating Vlans at firewall level or switch level, is one of the two options better than the other generally? more solid/secure/stable etc? or does not make a difference? only difference being the number of ports needed (few ports available on a firewall as far as I know vs like 48 on a switch if lot of users connected).

Thank you

[Richard Burts]

You ask " is one of the two options better than the other". The tricky part of answering that is how do you evaluate "better"? I would suggest starting with evaluating the economics of the alternatives. If you compare a firewall and a switch on the cost per port you realize that a firewall is much more expensive than a switch. The original post suggested configuring vlans with 15 ports per vlan. Why would you use 15 expensive firewall ports instead of 15 less expensive switch ports?

In my experience the access part of configuring and using vlans is almost always done on a switch and vlan on firewall is almost always because you want the firewall to do routing for the vlan.