VqLAN: Firewalla Microsegmentation

Follow

Comments

11 comments

  • Avatar
    Mark9

    @Firewalla, I am wondering whether I can use Port Isolation on a managed switch with Firewalla Microsegmentation.  On paper, it seems like Port Isolation mode on other manufacturer’s managed switches can be used to achieve full Firewalla Microsegmentation.  For example, Cisco’s Port Isolation means all traffic through a particular port is forwarded through the switch to an upstream router or intermediate switch which in turn can also have Port Isolation.  So, none of the downstream traffic is switched between Port Isolation device ports leaving Firewalla to handle switching/routing.  In essence, a switch with Port Isolation enabled basically expands a Firewalla port to many other ports.

    Port Isolation is easy to configure.  Just mark each switch port as Isolated except the upstream port.

    For example, let’s take a simple 5 port switch which is located several rooms from the Firewalla with 4 devices on it and Ethernet back to the Firewalla.  In Port Isolation mode, the 4 devices cannot talk to each other through the switch.  They can only talk to the Firewalla which may or may not switch/route traffic between the 4 devices depending on the Microsegmentation configuration. (Netgear calls this Protected Ports on their 5 port GS305EP.)

    We can then use managed switches near our Firewalla router to extend the number of ports, or remotely with a small managed as in the example so we only have to run one Ethernet cable for multiple remote devices in a room.

    0
    Comment actions Permalink
  • Avatar
    Johann R.

    From the description of the feature it is not entirely clear whether VqLAN can be enabled independently of having an AP7 or not (for wired devices, resp. for traffic flowing through Firewalla). From the fact that I don’t see the options in the (Beta) App in Groups, I take that an AP7 is probably mandatory for the feature to become visible. Which is obviously a shame since even with other AP‘s and wired (isolated) devices this feature makes tremendous sense.

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    VqLAN is a firewalla invention, so it really not possible to have it running on none firewalla products. 

    0
    Comment actions Permalink
  • Avatar
    Johann R.

    Yes but you state that traffic that flows through the Firewalla from „wired devices“ can be micro-segmented. Which means if a mechanism like port isolation on a switch or some other form of routing all traffic upstream to Firewalla exists I should in principle and according to this documentation be able to use micro segmentation „for wired devices“?!

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    VqLAN is a layer 2 or LAN function. So, if all of your devices are connected to the firewalla directly (no switch / AP's) in the middle, then yes, it is possible to make it work. But this is not practical. (if devices not connecting to the firewalla directly, and via a none Firewalla AP for example, firewalla can not control / manage traffic internal to the none Firewalla AP)

    1
    Comment actions Permalink
  • Avatar
    Johann R.

    Thanks. Which then leads me back to my original question: can this be enabled if I don’t have an AP7 in my network at all - as I can’t see the option in my Firewalla App (Beta/Early Access Gold Pro).

    Edit: I now see the requirement for AP7 on this page. Must have missed it beforehand. Apologies and thanks. 

    0
    Comment actions Permalink
  • Avatar
    Mark9

    I respectfully disagree with @Firewalla.  Isolated Port configuration on a switch will force all device traffic upstream, preventing any device to device traffic.  Thus if the managed switch with Isolated port functionality is hooked up to the Firewalla router (or to another switch with Isolated Port configuration which is in turn hooked up to the Firewalla router), then the Firewalla will see ALL traffic and can manage it. (Isolated is Cisco terminology.  Netgear uses Protected port terminology.).

    I second the request for VqLAN functionality to be enabled in Firewalla routers!!!  Please.

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    Are you talking about having firewalla directly controls these switches and pushes the policies down? It may be not be possible, even possible, having your firewalla adopting to different devices is not going to be cheap. (Some of these devices are not that programmable.)

    Also, VqLAN can be a group, so "isolation" or "port isolation" really doesn't work that well since they limit device-to-device communication, whereas VqLAN allows members in the group to talk. 

    0
    Comment actions Permalink
  • Avatar
    Johann R.

    I appreciate your response. To clarify, I'm not suggesting that Firewalla starts controlling third party network hardware like Switches or AP. I'm just suggesting that VqLAN functionality could be enabled on the Firewalla router itself for wired traffic that already flows through it (independent of the presence of an AP7 in the network). 

    When switches with port isolation are configured properly, they force all traffic upstream to the router. The Firewalla would see this traffic at Layer 2 and could apply the same microsegmentation rules as the AP7. 

    (To a certain extent, a feature like “local flows” faces the same problem: “local flows” and traffic can only be analysed properly if all traffic flows through the Firewalla, and by enabling this feature, you alredy confirmed that apparently, you trust your users to be able to use it properly in more complex network environments).

    0
    Comment actions Permalink
  • Avatar
    Mark9

    No, I am not suggesting that Firewalla configure a Cisco, Netgear or other managed switch with Port Isolation/Protection.  While that would be nice to do on our behalf, it is simple and straightforward for us to configure a switch with N ports to have N-1 of those ports with Port Isolation/Protect enabled, leaving the final port for the upstream connection to a Firewalla router port.  Of course you can also daisy chain these switches too.  This will cause all device traffic to be delivered to the Firewalla router.

    The Firewalla router has all of the VqLAN rules and would decide whether or not to forward a packet from one device to another device.  If the packet is to be forwarded, it will go out the appropriate Firewalla port, just like a packet arriving from the WAN, to the destination device.

    In many ways, this is similar to a Firewalla router that has enough physical ports to connect every device in your house.  Of course, this requires more CPU processing in the Firewalla router than offloading to a switch.  But lots of us have enough CPU (I have a Gold Plus with a 1Gb WAN).  And if not, we can always upgrade to the Gold Pro!

    Even when Firewalla introduces a N port switch, this will be useful.  For example, I have 5 port switches in a lot of rooms.  I don’t want to replace them with much more expensive Firewalla switches.  And I don’t want to run more Ethernet cables back to a central Firewalla switch.  I do want the Firewalla switch be smart enough so that we can plug in our switches configured with Port isolation/Protection and have the Firewalla switch handle all LAN to LAN traffic internally without passing any of it back to the Firewalla router unless it is going to another LAN port on the Firewalla router.

    0
    Comment actions Permalink
  • Avatar
    DanM

    Not a networking expert but this sounds like a very logical approach to tunnel thru a network from an endpoint switch (commingled inputs) and deliver the data intact to the FW router. Just like being a home run to the router. It would be fantastic if a solution could be enabled to accomplish this option

    0
    Comment actions Permalink

Please sign in to leave a comment.