Configure Firebox VLANs

Applies To: Cloud-managed Fireboxes

For a cloud-managed Firebox, you can configure any network as a VLAN (virtual local area network). To configure a VLAN, you must enable the VLAN option for an existing external, internal or guest network.

For information about how to add a network and configure other network settings, see:

Enable a VLAN

In the network settings, you can enable the VLAN option and specify the VLAN ID. For each interface associated with the network you can also specify whether VLAN traffic on the interface is tagged or untagged.

  • For an internal or guest network, VLAN traffic can be tagged or untagged.
  • For an external network, VLAN traffic must be tagged on all associated interfaces.

To configure a network as a VLAN, from WatchGuard Cloud:

  1. Select Configure > Devices.
  2. Select the cloud-managed Firebox.
  3. Click Device Configuration.
  4. Click the Networks tile.
    The Networks configuration page opens.
  5. Click the tile of the network to edit.
    The network configuration page opens.

Screen shot of the Internal network IP address

  1. Select the Enable VLAN check box.
    A confirmation message appears.

  1. To confirm the change, click Enable VLAN.
    All interfaces associated with the network change to untagged VLAN interfaces.
  2. In the VLAN ID text box, type the VLAN ID for this network.
  3. For an external network, edit each interface to change the setting to Tagged VLAN, as described in the next section.
  4. To save configuration changes to the cloud, click Save.

Configure Interface Settings for a VLAN

When you enable VLAN in the network settings, any interfaces associated with the network handle untagged VLAN traffic by default. To configure whether each interface handles tagged or untagged VLAN traffic, in the network configuration, select the setting for each interface.

For an external network, you must configure all associated interfaces to handle tagged VLAN traffic.

Firewall policies apply to intra-VLAN traffic for external VLAN interfaces. Firewall policies do not apply to intra-VLAN traffic for internal VLAN interfaces. You cannot configure intra-VLAN traffic settings in WatchGuard Cloud.

To configure the VLAN settings for an interface, from WatchGuard Cloud:

  1. Edit the VLAN network.
  2. To see VLANs associated with an interface, in the interface tile, point to View Networks.

Screen shot of the View Networks information for an untagged VLAN interface

  1. To change the interface setting, from the interface options () menu, select:
  • Untagged VLAN — Interface handles untagged VLAN traffic
  • Tagged VLAN — Interface handles tagged VLAN traffic
  • No Traffic — Interface is not associated with this network

The options menu shows only options you can select, and does not include the currently configured option.

  1. To save configuration changes to the cloud, click Save.

Configure Multiple VLANs on the Same Interface

Each interface can handle traffic for multiple VLANs. After you configure a network to send VLAN traffic to one interface, you can also configure other networks to send VLAN traffic to the same interface. Only one network can send untagged VLAN traffic to each interface.

To configure an interface to handle traffic for multiple VLANs:

  1. Enable the VLAN option in each network and assign unique VLAN IDs.
  2. In each network, configure the interface to handle tagged or untagged VLAN traffic.

After you configure a VLAN to send untagged VLAN traffic to an interface, the Untagged VLAN option is not available for that interface in other VLANs.

After you configure an interface to handle tagged VLAN traffic for multiple networks, View Networks shows the Networks and VLAN IDs for tagged VLAN traffic for each VLAN on that interface.

Screen shot of View Networks for an interface that handles tagged VLAN traffic for VLANs

After you configure an interface to handle both tagged and untagged VLAN traffic, View Networks shows the networks and VLAN IDs for tagged VLAN traffic, and the network name for untagged VLAN traffic.

Screen shot of View Networks for an interface that handles both tagged and untagged VLAN traffic

See Also

About Firebox Networking Settings