Who rated this post

@DSzymanski,

You don't need to configure an IP address on the VLAN interface or the subinterface if you don't want to and the config will be valid, but how are you going to route that? 

I think we might be confusing a few things here though. So I'm going to feed a little bit of information about each example here and you can pick whichever one is applicable to your enviroment. 

Layer3

You aren't configuring a VLAN on a Layer3 interface, you are simply configuring a Tag, usually on a sub-interface. 

1) I have ethernet1/8 configured as a Layer3 interface; this interface does not have an IP address.

2) I create a subinterface of ethernet1/8.232 (doesn't need to be 232, but to me it's cleaner) and set the Tag value as 232 as I have a VLAN 232 on the switch I want to utilize this interface for. 

3) I configure 1/8.232 to be assigned VR 'default' and then the Security Zone as 'trust' and assign it the IP address 10.191.232.1/22, as I want the interface to act as my default gateway as all hosts in vlan232. 

4) Repeat the process for any VLAN you have on the switch. 

Notes:

- The link between ethernet1/8 and the switch needs to be a 'trunk' so that the VLAN tag is applied to the header of the packet. 

- Subinterface 1/8.232 is going to match any traffic with the VLAN tag '232', and since it's the default gateway will handle all VLAN232 traffic. 

- This is NOT adding the VLAN to the firewall at all. This is specifying that subinterface 1/8.232 should handle any traffic with the tag '232' but nothing else. The Firewall doesn't participate in the VLAN, it simply handles the routing and forwarding for the VLAN as we've configured it as the gateway. 

- You don't need to create a VLAN interface or a VLAN object for this configuration; the VLAN doesn't matter as you are only looking for the VLAN Tag on the packets. 

- The subinterface 1/8.232 needs an IP address as otherwise you can't properly route the traffic. The configuration is considered valid without an IP address, but you will not be able to route traffic properly. 

Layer2: 

This is where the firewall actually functions as a member of the VLAN and doesn't just process the traffic. The firewall will participate in the VLAN the same as a switch would, and the configuration is a little bit harder to explain as there's a couple way to set this up. 

1) You create the VLAN interface that will be used by the physical interfaces which are configured as Layer2 interfaces. You assign this interface an id (Doesn't need to be VLAN tag), assign the Virtual Router, and the Zone. You can configure an IP address directly to the VLAN interface but whether or not you do so is up to you. 

2) You'll assign the VLAN interface a VLAN that you've created or that you create right now. This doesn't really contain much of anything unless you have Static MAC configuration statements that you need to configure.  

3) One of your interfaces will need to be configured as a Layer2 interface, and you'll set the VLAN to the VLAN object that we just created in 2 and select the security zone that you wish to assign the interface to (Note that you can't mix Layer2 and Layer3 in the same security zones). 

4) If you are looking to route via Layer2 interfaces (and lets face it you are otherwise you would have just used v-wire) you generally put the IP address directly on the VLAN interface that you created. 

5) Create any routes that you need in the selected VR. 

Notes:

- You can create a 'native' or untagged Layer2 interface as the physical interface (ex ethernet1/8).

- Additional VLANs can be configured as subinterfaces on any Layer2 interface, you simply need to configure the interface with the proper Tag and assign it to the proper VLAN. 

- Layer2 is the only configuration that allows the firewall to actively participate in the VLAN the same way that a switch would.