Vlan routing

[jacksonvld]

Hello gentlemen,
I need help from the most experienced.
I have the following vlans configured on my core switch:
1 - Default - 192.168.1.2/24
2 - IT - 172.17.41.1/24
3 - Fin - 172.17.36.1/24
4 - My Default gateway is 192.168.1.1 (My Firewall).

I don't want communication between vlans, but I need them to be able to go out to the internet, going through the firewall.

I have tried to configure static route, enable ipforwarding, ACL denying traffic between vlans when ipforwarding is enabled, but still without success.

Can someone please help me?

Sorry for the mistakes I use google translate.

[Miguel-Angel_RO]

Jackson,

There could be several alternatives for this but it is really poor design and I wouldn’t recommend them.

Never forget that a switch/router is not a firewall and a firewall is not a switch/router.

Trying to put firewalling rules in a switch is a very bad habit and become quickly unmanageable. ACL on switches are stateless so you need to foresee them in a two way communication.

This being said, the only solutions I see for you is to set ACLs to deny the unwanted traffic and/or allow the authorized traffic(DHCP/ARP/DNS/Internet).

Mig

[jacksonvld]

Good morning gentlemen,
I understood your suggestion. I am looking for an alternative in which SWITCH CORE does all the routing without the vlan gateway on the firewall (tagged).
When I enable ipforwarding, routing occurs as I would like, but the vlans become able to access other vlans.

Again, sorry for the English, I use the Google translator

[Miguel-Angel_RO]

And make security rules on the firewall

Spoiler!!

[JohanHendrikx]

And make security rules on the firewall

[Miguel-Angel_RO · Accepted solution]

Jackson,

First shot is to remove the ipaddress from the vlans and put them on the vlan interface of the firewall.

If you want more specific answers you’ll have to share a topology design.

Mig