1 2 Previous Next 17 Replies Latest reply: Jul 15, 2013 11:12 AM by grinder RSS

    S2008 VLAN Routing?


      Hello all.  I am new to setting up firewalls.  I do understand most of it but just have never done it before.  I would like to know if routing between different subnets on the same interface is possible.  Or do I need to buy some other piece of equipment.  What I am trying to do is have EM1 setup for multiple IP's and subnets. 



      IP:     Subnet:

      IP:     Subnet:

      IP:     Subnet:

      IP:     Subnet:


      I want to be able to route between the subnets so a device with an IP of can communicate with an IP of


      So far I have not been able to get this to work.  I tried just adding alias IP's to the EM1 interface and that did not work. So then I tried to use VLAN's like so.



      IP:     Subnet:     VLAN ID: 10

      IP:     Subnet:      VLAN ID: 11

      IP:     Subnet:     VLAN ID: 12

      IP:     Subnet:     VLAN ID: 13


      Then I built a policy to allow ANY from VLAN_10 to VLAN_12 and vice versa.  That does not work either. 


      Basically I have several devices (PC's, printers, wireless, etc.) all connected into dumb switches.  I want to be able to segregate the devices into different subnets.  So PC's into one subnet, printers in another, etc.  Is this possible and if so how?




      BTW this is a new firewall S2008 with v8.3.0 software.


      Message was edited by: grinder on 2/8/13 11:15:15 AM CST
        • 1. Re: S2008 VLAN Routing?



          The second option that you used is correct. You need to add four vlan interfaces.


          Once you do that, can you ping devices on those vlans? That would be the first thing I would focus on. When you are sure that connectivity is correct, then you can look at the policy. For example, what does the audit say when you try to pass traffic through?





          • 2. Re: S2008 VLAN Routing?

            I did create the VLAN's and once I did I could not even ping the Interface IP's which I find strange.  And I cannot of course ping any IP on any other subnet.  I haven't quite figured out how to use the aduit functionality but I will work on that.


            Here are some screen shots of my setup.  It is very basic at this time becuase I am testing it out.







            • 3. Re: S2008 VLAN Routing?

              Is your routing set up correctly outside the firewall?  If you try to ping from to, does 11.10 know to send this ping to the firewall first?  Is the firewall's default route?


              If so, and the ping goes through the firewall, does know that to talk back to he needs to send the packet back to the firewall's interface in the network?  Is the firewall's default route?

              If you set NAT to 'localhost (Host)' on your rules this will take a routing problem out of the equation.  If you set the NAT to localhost and this works you can say routing is the problem (routing outside the firewall).


              Whoops, I was using your actual firewall IP's as examples of CLIENT PC IP's.  I changed them all to .10s for clarity. on 2/8/13 11:53:37 AM CST
              • 4. Re: S2008 VLAN Routing?

                I do not have any routing outside of the firewall.  Maybe this is the issue?  I was hoping the firewall could route the packets across the VLAN's.


                The clients have the VLAN Interface IP set for the default gateway so a clinet would look like this as an example:







                I did a real quick layout of the test network:

                Sample Network.png


                Message was edited by: grinder on 2/8/13 12:21:35 PM CST
                • 5. Re: S2008 VLAN Routing?

                  Does the MFE add the VLAN tag to the packet if it does not exist?  There is no other device to add a VLAN tag because the path is PC-Switch-Firewall.

                  • 6. Re: S2008 VLAN Routing?

                    If the traffic is not tagged the firewall will drop it.

                    • 7. Re: S2008 VLAN Routing?

                      So if I change out my switches for managed switches that can add the VLAN tag then the firewall can route traffic between the VLAN's without needing to add some kind of router or L3 switch?

                      • 8. Re: S2008 VLAN Routing?



                        I took another look at your diagram. Since you are not doing any vlan tagging, it makes the most sense to connect each network to a different port on the firewall. Each port on the firewall would be assigned to a different zone and then you could enforce policy between the zones. The S2008 should have at least 8 ports, so you do have enough ports.


                        Note: Since your switches are not tagging the traffic, do not use vlans on the firewall.



                        • 9. Re: S2008 VLAN Routing?

                          Unfortunately I am going to have a lot more than eight subnets.  This is just a test environment.  So it looks like I need new switches.  But if I get the switches can I do the routing without needing a router? Will the firewall be the router?

                          1 2 Previous Next