1 2 Previous Next 17 Replies Latest reply: Jul 15, 2013 11:12 AM by grinder RSS

    S2008 VLAN Routing?

    grinder

      Hello all.  I am new to setting up firewalls.  I do understand most of it but just have never done it before.  I would like to know if routing between different subnets on the same interface is possible.  Or do I need to buy some other piece of equipment.  What I am trying to do is have EM1 setup for multiple IP's and subnets. 

       

      EM1

      IP: 192.168.10.1     Subnet: 192.168.10.0/24

      IP: 192.168.11.1     Subnet: 192.168.11.0/24

      IP: 192.168.12.1     Subnet: 192.168.12.0/24

      IP: 192.168.13.1     Subnet: 192.168.13.0/24

       

      I want to be able to route between the subnets so a device with an IP of 192.168.10.10 can communicate with an IP of 192.168.12.50

       

      So far I have not been able to get this to work.  I tried just adding alias IP's to the EM1 interface and that did not work. So then I tried to use VLAN's like so.

       

      EM1

      IP: 192.168.10.1     Subnet: 192.168.10.0/24     VLAN ID: 10

      IP: 192.168.11.1     Subnet: 192.168.11.0/24      VLAN ID: 11

      IP: 192.168.12.1     Subnet: 192.168.12.0/24     VLAN ID: 12

      IP: 192.168.13.1     Subnet: 192.168.13.0/24     VLAN ID: 13

       

      Then I built a policy to allow ANY from VLAN_10 to VLAN_12 and vice versa.  That does not work either. 

       

      Basically I have several devices (PC's, printers, wireless, etc.) all connected into dumb switches.  I want to be able to segregate the devices into different subnets.  So PC's into one subnet, printers in another, etc.  Is this possible and if so how?

       

      Thanks!

       

      BTW this is a new firewall S2008 with v8.3.0 software.

       

      Message was edited by: grinder on 2/8/13 11:15:15 AM CST
        • 1. Re: S2008 VLAN Routing?
          mtuma

          Hello,

           

          The second option that you used is correct. You need to add four vlan interfaces.

           

          Once you do that, can you ping devices on those vlans? That would be the first thing I would focus on. When you are sure that connectivity is correct, then you can look at the policy. For example, what does the audit say when you try to pass traffic through?

           

          Regards,

           

          Matt

          • 2. Re: S2008 VLAN Routing?
            grinder

            I did create the VLAN's and once I did I could not even ping the Interface IP's which I find strange.  And I cannot of course ping any IP on any other subnet.  I haven't quite figured out how to use the aduit functionality but I will work on that.

             

            Here are some screen shots of my setup.  It is very basic at this time becuase I am testing it out.

             

            Interfaces.png

             

            Zones.png

             

            Policy.png

            • 3. Re: S2008 VLAN Routing?
              sliedl

              Is your routing set up correctly outside the firewall?  If you try to ping from 192.168.11.10 to 192.168.12.10, does 11.10 know to send this ping to the firewall first?  Is the firewall 192.168.11.10's default route?

               

              If so, and the ping goes through the firewall, does 192.168.12.10 know that to talk back to 192.168.11.10 he needs to send the packet back to the firewall's interface in the 192.168.12.0/24 network?  Is the firewall 192.168.12.10's default route?


              If you set NAT to 'localhost (Host)' on your rules this will take a routing problem out of the equation.  If you set the NAT to localhost and this works you can say routing is the problem (routing outside the firewall).

               

              Whoops, I was using your actual firewall IP's as examples of CLIENT PC IP's.  I changed them all to .10s for clarity. on 2/8/13 11:53:37 AM CST
              • 4. Re: S2008 VLAN Routing?
                grinder

                I do not have any routing outside of the firewall.  Maybe this is the issue?  I was hoping the firewall could route the packets across the VLAN's.

                 

                The clients have the VLAN Interface IP set for the default gateway so a clinet would look like this as an example:

                 

                CLIENT1

                IP: 192.168.10.25

                MASK: 255.255.255.0

                Gateway: 192.168.10.1

                 

                I did a real quick layout of the test network:

                Sample Network.png

                 

                Message was edited by: grinder on 2/8/13 12:21:35 PM CST
                • 5. Re: S2008 VLAN Routing?
                  grinder

                  Does the MFE add the VLAN tag to the packet if it does not exist?  There is no other device to add a VLAN tag because the path is PC-Switch-Firewall.

                  • 6. Re: S2008 VLAN Routing?
                    sliedl

                    If the traffic is not tagged the firewall will drop it.

                    • 7. Re: S2008 VLAN Routing?
                      grinder

                      So if I change out my switches for managed switches that can add the VLAN tag then the firewall can route traffic between the VLAN's without needing to add some kind of router or L3 switch?

                      • 8. Re: S2008 VLAN Routing?
                        mtuma

                        Hello,

                         

                        I took another look at your diagram. Since you are not doing any vlan tagging, it makes the most sense to connect each network to a different port on the firewall. Each port on the firewall would be assigned to a different zone and then you could enforce policy between the zones. The S2008 should have at least 8 ports, so you do have enough ports.

                         

                        Note: Since your switches are not tagging the traffic, do not use vlans on the firewall.

                         

                        -Matt

                        • 9. Re: S2008 VLAN Routing?
                          grinder

                          Unfortunately I am going to have a lot more than eight subnets.  This is just a test environment.  So it looks like I need new switches.  But if I get the switches can I do the routing without needing a router? Will the firewall be the router?

                          1 2 Previous Next