Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Connection Switch L3 and Firewall

    Scheduled Pinned Locked Moved Routing and Multi WAN
    5 Posts 2 Posters 481 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      robertog
      last edited by

      Hello everyone!
      I hope someone can help me with my configuration…Below you can see it:

      firewall:
                    ip lan:  192.168.0.1/24
                    vlan68: 192.168.68.0/24
                    vlan69: 192.168.69.0/24
                    ip wan:  10.2.X.X/24 default gateway 10.2.x.x/24
      lan port connected with port 5 switch
      rules  lan/vlan68/vlan69 any any (just at moment...)

      switch L3:
                    ip lan: 192.168.0.3/24
                    vlan68: 192.168.68.0/24
                    vlan69: 192.168.69.0/24
      port 5 switch tagged for these vlan (68 and 69)
      default gateway 192.168.0.1

      If I ping from switch (192.168.0.3) to 8.8.8.8 is fine!
      ..........................................with source ip 192.168.68.x and 192.168.69.x to 8.8.8.8 not works...(:

      I hope someone can help me and thanks in advance!!!
      bye

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        You are calling it an L3 switch, but it looks like you are using it as an L2 switch. Or you're trying to do both which is nonsensical.

        A Layer 3 switch is just a router. A layer 3 switch VLAN without a VIF/SVI on it is just a Layer 2 switch.

        Need to know what, exactly, you are trying to do.

        pfSense-Layer-3-Switch.png
        pfSense-Layer-3-Switch.png_thumb

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • R
          robertog
          last edited by

          Hello Derelict,
          thank you for your answer I confirm the switch is configured as layer 3 and I created interface vlan with ip address for each vlan.
          from your answer I understand that I have downgrade the switch in layer 2 and probably it will be fixed.

          Thank you very much for you help!
          Bye

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            There is nothing wrong with using the layer 3 capabilities of your Layer 3 switch to route packets if that's what you want to do.

            But if you want to use the firewall capabilities of pfSense between the VLANs then you really only need a Layer 2 switch and should not be putting VIF/SVI on the switch itself on that VLAN. That will make all traffic have to go though the firewall to get from VLAN to VLAN.

            You can do both but it's pretty much one or the other per VLAN.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • R
              robertog
              last edited by

              thank you again, to finish my explanation…still I have home router (no manage inter-vlan) so long time ago I bought switch Layer 3 to create different
              subnet for each department in my office.
              In few days I want to replace my router with the firewall and I thought to keep the same configuration for switch (it's a pity downgrade to L2)
              and the setup properly the firewall but I see nosense...

              bye

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.