Question

  • Creator
    Topic
  • #2211607

    Switch VLAN’s inside/outside Firewall?

    Locked

    by tomjhen ·

    In the same room, there is a need for switches on both the protected and Internet sides of the firewall. If configured correctly, can a managed switch be safely used with separate VLAN’s inside and outside the firewall, rather than using 2 separate physical switches?

All Answers

  • Author
    Replies
    • #3028443

      Clarifications

      by tomjhen ·

      In reply to Switch VLAN’s inside/outside Firewall?

      Clarifications

    • #3028436

      sure provided you take the necessary precautions

      by cg it ·

      In reply to Switch VLAN’s inside/outside Firewall?

      to secure the vlan and the switchports on the vlan and configure the router access control list appropriately.

      • #3028400

        Setup

        by tomjhen ·

        In reply to sure provided you take the necessary precautions

        VLAN in protected network is trunked to other switches. VLAN for connections outside the firewall would only be on one switch and would not be trunked to any other switch. Switch ports for the connections outside the firewall would be “access” type (rather than trunk) and would be assigned only to the non-trunked VLAN.

        Are there other VLAN settings to be checked?

        Thanks much for your response!

        • #3028399

          so hosts in that VLAN which are in the DMZ get to the default gateway how?

          by cg it ·

          In reply to Setup

          if hosts in a vlan don’t need to get to the default gateway, then you simply remove them as allowed access on the trunk line. also make sure that switchports in the vlan can’t negotiate mode..

          If you need them to get to the default gateway, but need to block access for all other vlans and hosts, you setup a trunk line for it and deny all other vlans access on it. you also make sure switchports can’t negotiate modes

          The other thing to watch out for is VTP.

Viewing 1 reply thread