Firewalla Gold: Network Segmentation Use Cases

Follow

Comments

5 comments

  • Avatar
    Michael Bierman

    Is it possible to have unrecognized devices that join (wifi or ethernet) default to a certain segment ? Having an example of that would be great. 

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    Not possible to a segment.  But maybe possible to a group. (which you can add rules to the group to govern these devices).    The adding new devices to a group feature is not yet done (6/10/2020), hopefully we get to it

    Segments are physical, so it is hard to place devices.   Groups are virtual, so it is a bit easier.

    0
    Comment actions Permalink
  • Avatar
    remotebloke

    How do I move devices to the new VLAN?

    0
    Comment actions Permalink
  • Avatar
    Michael Bierman

    @remotebloke this will depend on your setup. Here are three common examples. 

    1. Start with Firewalla Gold in Router mode. Configure firewalla so that a port is a VLAN. Go to Firewalla app and Network Manager > Edit Create Network. Choose Local Network and select a port (just not port 4 which is your WAN). Choose Type VLAN. Enter a number for the VLAN ID but don't use "0" but say "22" will be fine. Whatever you plugin to that port will be on that VLAN. If this is a computer, that may (or may not) be useful but it is the simplest use case. It is a good way to try it out. When you are done, the IP assigned to that computer should be in the IP range that you saw when you created the VLAN on firewalla not an IP in your LAN range. Nothing special has to be done to configure the computer if it is in DHCP mode.
    2. Follow above but instead of plugging in a computer to that configured port on Firewalla, plugin a managed switch. Configure the switch so that the port connecting to Firewalla is a Trunk port (it carries the vlan traffic and lan traffic) to firewalla.  Check the instructions for configuring the switch with the manufacturer of the switch. Then set a different port on the switch to the same VLAN iD you just set up on Firewalla. This will mean anything you plugin to that port will be on that VLAN and be able to talk through the trunk to Firewalla and other devices on the VLAN. Now you can plugin the switch to the port you set before on Firewalla. Any ports on the switch you don't configure will be on the LAN only.
    3. You can follow the directions above but connect a wifi AP instead of a switch. Note If you are talking about a VLAN on wifi your AP (Access Point) will have to support VLANs. Not all do. If your AP supports VLANs configure the VLAN similar to what you did on the switch. If you plug the AP directly into Firewalla, configure that port to the VLAN. If you plug the AP into a switch make sure it is a trunk (that is it can carry traffic on both LAN and VLAN) as needed. For example I have ui APs that have 3 wifi networks. 1 LAN and 2 different VLANs for IoT devices. Configure your AP according to the manufacturer instructions and connect that to Firewalla (or a switch) as a trunk.  Any device that connects to the AP with a VLAN network will be given an IP address and be in that VLAN. If it connects to a LAN network then it will be on your LAN. 

    I know that's a lot to take in if you have never done it. There are plenty of folks who can help if you ask specific questions. 

    0
    Comment actions Permalink
  • Avatar
    remotebloke

    @michael thanks for the info - really useful i helping me understand.  I was hoping to have an isolated network for IoT devices and security cameras.  I don't think I'll be able to do that with APs (Deco X90), there's no mention of VLAN SSID support.  Unless I can do something with the guest network...

    0
    Comment actions Permalink

Please sign in to leave a comment.