Forwarding Internet traffic through 2 firewalls with no HA.

[hmc250000]

We have 2 firewalls, 1 Meraki MX 100 and the other a different vendor.  The non Meraki firewall is used for internet traffic and non Meraki site to site VPN's. The Meraki is primarily used for Client VPN.

We have a Meraki MS390 L3 switch.

We use a default route on the L3 to send traffic to the non Meraki firewall. 

Let's say we have 2 user networks, vlan 1 and vlan 2 on the LAN.  Vlan 1 uses the default route through the non Meraki firewall. How can we configure the L3 switch to have vlan 2 route through the MEraki firewall?

On a Cisco switch you would have the option to create an ACL and a route map to do this? What is the equivalent configuration on a Meraki switch?

[kYutobi]

You have a Meraki MX100 and a non-Meraki firewall, with the latter handling internet traffic and non-Meraki site-to-site VPNs, while the MX100 is used for Client VPN. Your MS390 Layer 3 switch currently has a default route pointing to the non-Meraki firewall, and VLAN 1 follows this path. To have VLAN 2 route through the Meraki MX100, you’ll need to assign an IP to VLAN 2 on the MS390, set its gateway to the MX100, and configure static routes on both the switch and firewall to ensure proper traffic flow. Since Meraki switches don’t support policy-based routing like Cisco, VLAN-based routing and firewall rules are your best options.

[hmc250000]

Sorry for some missing information but of course vlan 1 and vlan 2 have unique network ip addresses ranges. I just need to know if it's possible to configure the Meraki L3 to have 1 subnet route through 1 firewall and the other subnet through the other firewall. The firewalls are on a seperate vlan (not vlan 1 or vlan 2).

Not sure if I understood your reply correctly but how would you set the gateway for vlan 2 to the MX 100 if they're both on different vlans?

[rhbirkelund]

What mode is the MX100 in?

You could simply bypass your MS390, and just create vlan2 on the ports, and create the vlan 2 SVI on the MX, incase it's in Routed Mode.

[kYutobi]

Yeah, you can definitely set this up. The Meraki L3 switch can route VLAN 1 through one firewall and VLAN 2 through another, even though the firewalls are on a separate VLAN. Since Meraki switches don’t support Policy-Based Routing (PBR), you’ll handle this with static routes.

Basically, you’ll have VLAN 1 using the Meraki switch as its gateway, and then traffic from that VLAN gets sent to Firewall 1. Same deal with VLAN 2, except its traffic gets routed to Firewall 2. The firewalls will need to handle NAT properly so that return traffic follows the right path.

As for your gateway question, VLAN 2’s gateway will still be the Meraki switch (let’s say 192.168.2.1). The switch will then decide where to send the traffic—straight to Firewall 2 based on the static route.

[hmc250000]

As for your gateway question, VLAN 2’s gateway will still be the Meraki switch (let’s say 192.168.2.1). The switch will then decide where to send the traffic—straight to Firewall 2 based on the static route.

How would you do this if a default route is already present on the L3 switch? How would you add another static route pointing to a different gateway for destination 0.0.0.0/0?

[kYutobi]

Keep the default route to Firewall 1, but add more specific static routes to send VLAN 2’s traffic to Firewall 2. Splitting internet traffic into two halves (0.0.0.0/1 and 128.0.0.0/1) and routing those to Firewall 2. This way, VLAN 2 bypasses the default route without needing Policy-Based Routing.

[hmc250000]

I like your creativity, but this can potentially become quite an ordeal to manage which I would want to avoid. 

Just to mention a few, monitoring and zscaler, could make it a mess.