Configure Network Settings > Network Interface Settings > Network Setup Examples > Configure One VLAN Bridged Across Two Interfaces

Configure One VLAN Bridged Across Two Interfaces

You can configure a VLAN to bridge across two interfaces of the Firebox. You might want to bridge one VLAN across two interfaces if your organization is spread across multiple locations. For example, suppose your network is on the first and second floors in the same building. Some of the computers on the first floor are in the same functional group as some of the computers on the second floor. You want to group these computers into one broadcast domain so that they can easily share resources, such as a dedicated file server for their LAN, host-based shared files, printers, and other network accessories.

This example shows how to connect two 802.1Q switches so that both switches can send traffic from the same VLAN to two interfaces on the same Firebox.

A diagram of the VLAN architecture described in this topic.  In the diagram, Switch A is connected to interface 3, and Switch B is connected to interface 4.

In this example, two 802.1Q switches are connected to Firebox interfaces 3 and 4, and carry traffic from the same VLAN.

Define the VLAN on the Firebox

On the Firebox, configure VLAN 10 to handle tagged VLAN traffic from interfaces 3 and 4.

To apply firewall policies to the traffic between the two networks that are part of this VLAN, select the Apply firewall policies to intra-VLAN traffic check box in the VLAN configuration. For more information, see Define a New VLAN.

Configure the Switches

Configure each of the switches that connect to interfaces 3 and 4 of the Firebox. Refer to the instructions from your switch manufacturer for details about how to configure your switches.

Configure the Switch Interfaces Connected to the Firebox

The physical segment between the switch interface and the Firebox interface is a tagged data segment. Traffic that flows over this segment must use 802.1Q VLAN tagging. 

Some switch manufacturers refer to an interface configured in this way as a trunk port or a trunk interface.

On each switch, for the switch interface that connects to the Firebox:

  • Disable Spanning Tree Protocol.
  • Configure the interface to be a member of VLAN10.
  • Configure the interface to send traffic with the VLAN10 tag.
  • If necessary for your switch, set the switch mode to trunk.
  • If necessary for your switch, set the encapsulation mode to 802.1Q.

Configure the Other Switch Interfaces

The physical segments between each of the other switch interfaces and the computers (or other networked devices) that connect to them are untagged data segments. Traffic that flows over these segments does not have VLAN tags.

On each switch, for the switch interfaces that connect computers to the switch:

  • Configure these switch interfaces to be members of VLAN10.
  • Configure these switch interfaces to send untagged traffic for VLAN10.

Physically Connect All Devices

  1. Use an Ethernet cable to connect Firebox interface 3 to the Switch A interface that you configured to tag for VLAN10 (the VLAN trunk interface of Switch A).
  2. Use an Ethernet cable to connect the Firebox interface 4 to the Switch B interface that you configured to tag for VLAN10 (the VLAN trunk interface of Switch B).
  3. Connect a computer to the interface on Switch A that you configured to send untagged traffic for VLAN10.
  4. Configure the network settings on the connected computer. The settings depend on whether you configured the Firebox to act as a DHCP server for the computers on VLAN10 in Step 9 of Define the VLAN on the Firebox.
  • If you configured the Firebox to act as a DHCP server for the computers on VLAN10, configure the computer to use DHCP to get an IP address automatically. See Step 9 in the procedure Define the VLAN, above.
  • If you did not configure the Firebox to act as a DHCP server for the computers on VLAN10, configure the computer with an IP address in the VLAN subnet 192.168.10.x. Use subnet mask 255.255.255.0 and set the default gateway on the computer to the Firebox VLAN IP address 192.168.10.1
  1. Repeat the previous two steps to connect a computer to Switch B.

Test the Connection

After you complete these steps, the computers connected to Switch A and Switch B can communicate as if they were connected to the same physical local area network. To test this connection you can:

  • Ping from a computer connected to Switch A to a computer connected to Switch B.
  • Ping from a computer connected to Switch B to a computer connected to Switch A.

Give Us Feedback     Get Support     All Product Documentation     Technical Search