03-29-2011 05:41 PM
We have a netscreen-50 firewall, where one of the interface will be used to output
two vlans to a switch. I was wondering if the netscreen-50 firewall is going to strip the vlan tag or will it leave
it in tack for the switch to direct traffic properly?
03-30-2011 05:43 AM
You cannot pass the vlan tags across your firewall.
The purpose of the 802.1q support is to allow the firewall to connect to multiple subnets over 1 physical connection. After that it's Layer 3 only through the firewall policy.
03-30-2011 02:54 PM
You can connect a single port on the firewall to a trunk port on the switch and pass both vlans across the connection. In this scenario the firewall port does not have any ip information or zone. You create sub-interfaces to have a tagged trunk port on the firewall and then create matching vlans on the connected switch port.
Note that vlan1 is reserved for the device management only and cannot be used as a processed vlan.
The notes below assume SceeenOS version 6. I'm not sure if the syntax or functions are different in version 5.4 software.
For example if the interface is ethernet0/1
Prepare the connecting interface by removing any existing zone and ip address.
unset int ethernet0/1 ip
unset int ethernet0/1 zone
create your two vlan zones
set zone name vlan10
set zone name vlan20
create the sub-interfaces for your trunk port
set interface ethernet0/1.1 tag 10 zone vlan10
set interface ethernet0/1.2 tag 20 zone vlan20
set interface ethernet0/1.1 ip 10.0.10.1/24
set interface ethernet0/1.2 ip 10.0.20.1/24
Concepts and examples guide Volume 10 Virtual systems
Defining Sub-interfaces and vlan tags
Senior IP Engineer - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP)
JNCIA-Junos JNCIS-SEC JNCIP-SEC JNCSP-SEC
JNCDA JNCDS-DC JNCDS-SEC
ACE PanOS 6