Any security advantages to OPT port/interface over VLAN Interface ?
-
I'm wondering if there is any security advantages in segregating a device on its own built in port/interface over segregating it on its own a VLAN.
An example: Say I have an AP which allows for 2 SSIDs with VLAN tagging and add each of these VLANs as interfaces in pfSense and create firewall rules isolating each VLAN. Is this less secure in any way than doing the same thing but on the OPT port/ interface.
-
@CharlesT said in Any security advantages to OPT port/interface over VLAN Interface ?:
AP which allows for 2 SSIDs with VLAN tagging
Well in that scenario - how would you connect this AP to the network.. Which AP has discrete ports that can be set for a specific network vs vlans over the 1 port.. You can have one untagged sure.. But your limited to 1 physical port that you want to run multiple networks over - which is vlans.
The advantage of using physical ports would be better control of data flow, and no hairpin traffic when you had inter vlan/network traffic.
Unless you physically use different switches your always going to have "vlans" on the switch even if you use native untagged traffic to pfsense, ie the router.
Unless you were in some shared DC where a customer required different physical infrastructure for their traffic - you normally use just vlans to isolate networks.. I use some different non vlan uplinks from my switch to pfsense for some of my networks - and others I use just vlans over the same physical wire.. But these networks do not have any or much intervlan traffic, and they are wireless networks that wouldn't be saturating the physical interface anyway for bandwidth - so sharing the uplink is fine.. But since I have the ports to spare on my pfsense and my switch I do use non vlan uplinks into pfsense from the switch for some of my vlans on the switch - again mostly for removing any possibility of hairpinned traffic flow.
-
@johnpoz So as far as setting up firewall rules, there is no difference in security between VLAN Interfaces and physical port-based interfaces, is what I am hearing (reading) you say ? correct?
-
@CharlesT there is no difference..
