switches and firewall

[Messy]

Hello,

Apologies, couldnt think of a helpful title.


I was wondering about firewalls rules that deal with inter-vlan routing. If we put our VLAN interfaces on the MX, then routing traffic will go through the MX and it can apply its firewall rules.


However what happens if the interface is on the switch? Traffic wont touch the MX so no firewall rules apply I assume (ignoring WiFi / group policy rules).

If we wanted to restrict certain VLAN to VLAN talk, is out only option ACL's ?(apart form moving the interface to a MX)

thanks!

[Mloraditch · Accepted solution]

You are correct. The MX can only inspect traffic it sees. It will not see intervlan traffic where a switch is the home of the vlan.

You would need to use switch ACLs.

You could also use 802.1x solutions in combination with group or adaptive policies 

[DarrenOC]

Hi @Messy, I don’t know your environment or business requirements etc but for the sake of simplicity why not move all SVIs into your MX?  Then your can restrict inter-vlan traffic on a single device rather than manage both ACLs and MX firewall rules?

[Messy]

yea that's what we do now but for whatever reason we seem to have multiple sites where some or all VLANs were put on the switches. Probably a hang over from transitioning to Meraki where engineers just set them up the way they were on the old hardware.