The security appliance supports Virtual LANs (VLANs), which allow you to segregate the network into LANs that are isolated from one another. The default configuration provides for a data VLAN and a voice VLAN, which can be treated like two separate networks.
You can change the settings for the default VLANs, and you can add new VLANs, for up to a total of 16 VLANs. For example, if you need a guest network for visitors to your site, you can create new VLAN. Any PC that is connected to the specified LAN port is on a separate VLAN and cannot access other VLANs, unless you enable inter VLAN routing.
Networking
Configuring the LAN
2
This section includes the following topics:
• Default VLAN Settings
• Enabling or Disabling VLAN Support
• Creating VLAN IDs
• Assigning VLANs to LAN Ports
Default VLAN Settings
By default, the data VLAN and the voice VLAN are enabled with the following settings:
• Data VLAN: The VLAN is enabled with the VLAN ID 1 - VLAN - Data, VLAN Number (untagged packets): 1 - VLAN - Data, IP Address: See Product Tab
- VLAN - Data, IP Address Distribution: DHCP Server
- VLAN - Data, Start IP Address: 192.168.75.50 (assuming LAN IP address is 192.168.75.1)
- VLAN - Data, End IP Address: 192.168.75.254 (assuming LAN IP address is 192.168.75.1)
- VLAN - Data, Subnet Mask: 255.255.255.0
- VLAN - Data, Lease Time in Minutes: 1440 (24hours) - Lease Time in Minutes: 1440 (24hours)
- HTTP Remote Access: disable - HTTPS Remote Access: disable
• Voice VLAN: The VLAN is enabled with the VLAN ID 100.
- IP Address: 10.1.1.1
- IP Address Distribution: DHCP Server - Start IP Address: 10.1.1.50
- End IP Address: 10.1.1.254
Networking
Configuring the LAN
2
Enabling or Disabling VLAN Support
By default, VLAN support is enabled. If you do not want VLANs, you can disable VLAN support.
STEP 1 Click Networking > VLAN > VLAN Configuration.
The VLAN Configuration window opens.
STEP 2 To enable VLAN support, check the Enable VLAN box. To disable VLAN support, uncheck the box.
STEP 3 Click Apply to save your settings.
NOTE Next steps:
Create VLAN IDs. For more information, see Creating VLAN IDs, page 48.
Creating VLAN IDs
Before you can configure a new VLAN, you need to create the VLAN IDs. Later you will assign VLAN IDs to ports on the Port VLANs page.
STEP 1 Click Networking > VLAN > Available VLANs.
The Available VLANs window opens. The default VLAN and any other VLANs appear in the List of available VLANs table. The default VLAN ID is 1.
STEP 2 To add a VLAN, click Add.
Other options: To delete an entry, check the box, and then click Delete. To edit an entry, check the box, and then click the Edit button. To select all entries in the table, check the box at the left side of the heading row.
After you click Add or Edit, the VLAN Configuration window opens.
STEP 3 Enter the following information:
• Name: Enter a descriptive name, for reference.
• ID: Enter a unique identification number, which can be any number from 2 to 4091.
Networking
Configuring the LAN
2
NOTE VLAN ID 1 is reserved for the default VLAN, which is used for untagged frames received on the interface. VLAN IDs 4092 is reserved and cannot be used.
• Inter VLAN Routing Enable: Check the box if you want to allow the SA500 to route traffic between this VLAN and other VLANs that also have inter-VLAN routing enabled. Uncheck the box to disable inter-inter-VLAN routing for this VLAN.
STEP 4 Click Apply to save your settings.
NOTE Next steps:
• Assign the VLANs to LAN ports. For more information, see Assigning VLANs to LAN Ports, page 49.
• Set up VLAN subnets. For more information, see Multiple VLAN Subnets, page 50.
Assigning VLANs to LAN Ports
To assign a VLAN to a LAN port, choose the mode and assign VLAN membership.
STEP 1 Click Networking > LAN > Port VLAN.
The Port VLANs window opens. The existing port VLAN settings appear in the Port VLANs table.
STEP 2 To update the settings for a port, click the Edit button.
STEP 3 In the VLAN Configuration area, enter the following information:
• Mode: Choose one of the following options:
- Access: The access port is a member of a single VLAN. All data going into and out of the access port is untagged. By default, all VLAN ports are in access mode. Access mode is recommended if the port is connected to a single end-user device which is VLAN unaware.
If you choose this option, also enter a VLAN ID for the port, in the PVID field.
- General: The port is a member of a specified set of VLANs. The port sends and receives both tagged and untagged data. Untagged data
Networking
Configuring the LAN
2
General mode is recommended if the port is connected to an unmanaged switch with a mix of VLAN-aware and VLAN-unaware devices.
If you choose this option, also enter a PVID number for the port, and configure the VLAN Membership in the lower half of the page.
- Trunk: The port is a member of a specified set of VLANs. All data going into and out of the port is tagged. Untagged data coming into the port is not forwarded, except for the default VLAN with PVID=1, which is untagged. Trunk mode is recommended if the port is connected to a VLAN-aware switch or router.
If you choose this option, also configure the VLAN Membership in the lower half of the page.
• PVID: If you chose Access or General mode, enter the Port VLAN ID to be used to forward or filter the untagged packets coming into port.
STEP 4 In the VLAN Membership Configuration area, check the box for each VLAN that you want to associate with this port.
STEP 5 Click Apply to save your settings.
Multiple VLAN Subnets
Typically, VLANs are isolated such that the traffic generated by any one of these networks is not seen by the others. However there are instances where you want to enable communication between VLANs. When you configure VLAN subnets, the security appliance routes traffic between VLANs and provides services such as a DHCP server for the members of each VLAN.
STEP 1 Click Networking > VLAN > Multiple VLAN Subnets.
The Multiple VLAN Subnets window opens. All VLANs from the Networking >
LAN > Available VLANs page appear in the List of available Multiple VLAN Subnets table.
The Multiple VLAN Subnet Configuration window opens.
STEP 2 In the Multiple VLAN Subnet section of the page, enter the following settings:
• IP Address: Enter the VLAN subnet IP address.
• Subnet Mask: Enter the subnet mask for this VLAN.
STEP 3 In the DHCP section of the page, choose the DHCP mode:
Networking
Configuring the LAN
2
• None: Choose this option if you do not want to enable a DHCP server for this VLAN.
• DHCP Server: Choose this option to allow the security appliance to act as a DHCP server for this VLAN. If you choose this option, complete the other fields in this section of the page.
• DHCP Relay: Choose this option to allow the security appliance to use a DHCP Relay for this VLAN. If you choose this mode, also enter the IP address of the Relay Gateway.
STEP 4 If you chose DHCP Server for the DHCP Mode, enter the following information:
• Domain Name: (optional) Enter a domain name for this VLAN.
• Starting IP Address: Enter the first IP address in the DHCP range. Any new DHCP client joining the VLAN is assigned an IP address between this address and the Ending IP Address.
• Ending IP Address: Enter the last IP address in the DHCP range. Any new DHCP client joining the LAN is assigned an IP address between the Starting IP Address and this IP address.
NOTE The Starting and Ending DHCP addresses should be in the same IP address range as the LAN TCP/IP address (as configured on the LAN > IPv4 LAN Configuration page, LAN TCP/IP Setup section).
• Primary DNS Server and Secondary DNS Server (Optional): Enter the IP address of the primary DNS server for the VLAN. Optionally, enter the IP address of a secondary DNS server.
• Primary Tftp Server and Secondary Tftp Server (Optional): Enter the IP address of the primary and secondary Tftp servers for the VLAN
• WINS Server (Optional): Enter the IP address for the WINS server or, if present in your network, the Windows NetBios server.
• Lease Time: Enter the maximum connection time in hours that a dynamic IP address is “leased” to a network user. When the time elapses, the user is automatically assigned a new dynamic IP address. The default is 24 hours.
STEP 5 In the LAN Proxies section, check the Enable DNS Proxy box to allow the VLAN to act as a proxy for all DNS requests and to communicate with the DNS servers of the ISP. When this feature is disabled, all DHCP clients on the VLAN receive the DNS IP addresses of the ISP.
Networking
Configuring the LAN
2
This feature is particularly useful in Auto Rollover mode. For example, if the DNS servers for each connection are different, then a link failure may render the DNS servers inaccessible. However, when the DNS proxy is enabled, then clients can make requests to the router and the router, in turn, sends those requests to the DNS servers of the active connection. You also can enable the IGMP proxy on the respective LAN.
STEP 6 Click Apply to save your settings.