best pratctice firwall rules

[Herixon]

Hi,

We have different networks in a same template with autovpn between them. We want to isolate a subnet in (VLAN10) so it can't communicate with RFC1918 addresses in the network BUT we want that all vlans10 in other networks can talk to each other. What is the best practice to do it?

Right now I have a firewall rule in the outbound layer 3 section that deny any traffic from vlan 10 to RFC1918 addresses. Is it enough or should I add deny rules in  site-to-site outbound firewall as well?

[PhilipDAth · Accepted solution]

Allocate a supernet for all VLAN10's, for example 192.168.0.0/19.

Then create a firewall rules like:

permit 192.168.0.0/19 192.168.0.0/19

deny 192.168.0.0/19 all rfc1918 address space

You will need a VPN firewall rule as well.

[Herixon]

Thank you! Unfortunately we can't allocate a supernet but we will add rules in vpn firewall. 🙂