VLAN and LAGG

Summary

Connect your Ixolate Appliance successfully to a Managed Switch using OSI Layer 2 protocols like LAGG and VLAN.

Introduction

A VLAN (Virtual Local Area Network) allows to create separate Layer 2 networks within the same physical switch. This means you can segment a single physical network into multiple logical networks, keeping different groups of devices isolated from each other even though they are connected to the same switch.

VLAN are usually categorized as tagged and `untagged`:

• Tagged VLAN: Frames are sent with VLAN tags embedded in them. This allows multiple VLANs to be carried over a single network link, typically between switches or VLAN-aware devices. Tagged VLANs are used on trunk ports to identify which frame belongs to which VLAN.

• Untagged VLAN: Frames are sent without VLAN tags. The switch port assigns incoming untagged frames to a default VLAN. Untagged VLANs are typically used on access ports connected to end devices that are not VLAN-aware, such as computers.

Each VLAN will represent its own isolated network, connected by a VLAN-aware router like the Ixolate. Traffic that should cross VLAN boundaries must be routed and controlled via firewall rules. This is known as Inter-VLAN-Routing.

This guide will explain the best practice approach. Since switches from different vendors offer divergent configuration paths, only a guideline can be provided.

Setup Overview

In our basic setup, we have a Managed Switch and an Ixolate Appliance.

We need isolate:

• a LAN network with PCs, we assigned VLAN 5
• a DMZ network with Web Servers, we assigned VLAN 20
• a GUEST network with clients connecting to a Guest Wifi, we assigned VLAN 33

The Ixolate and the Switch are either connected with a single network cable, or with multiple network cables via Link Aggregation. The Port Mode describes the configuration of the Managed Switch ports.

Configuration

1. Setup LAGG Interface (optional)

See the section on LAGG for more details.

• Go to Interfaces › Devices › LAGG and add a new entry:

Afterwards, create the same LAGG interface on the Managed Switch and assign one or more physical interfaces to it. Connect the Ixolate Appliance and the Managed Switch via one or multiple network cables to establish the link layer. Verify the status of the LAGG interface as up before continuing.

2. Add VLAN Interfaces

See the section on VLAN for more details.

In our example setup we require tagged VLAN 5 (LAN), 20 (DMZ) and 33 (GUEST), and no untagged VLAN. If you skipped Step 1, create the VLAN directly on a physical interface like igc0.

• Go to Interfaces › Devices › VLAN and add new entries:

• Go to Interfaces › Assignments and assign the new VLAN interfaces. The parent interface should stay unassigned. In rare cases, the parent interface can be assigned without a network configuration, to allow manual link speed overrides.

• On the Managed Switch, create the same tagged VLANs on the LAGG or physical interface. Make sure there is no Native-VLAN-ID or default VLAN on the trunk port that connects to the Ixolate.

3. Create Networks on VLANs

To create connectivity between assigned VLAN interfaces via Inter-VLAN-Routing, configure a network on them. It is good practice to embed the VLAN IDs into the layer 3 networks, if possible.

With VLANs configured, PCs in LAN, Web Servers in DMZ and Guest Wifi clients in GUEST are isolated, even though they are connected to the same switch.

The Ixolate is responsible to route packets between VLANs.

It is the default gateway in VLAN 5, 20 and 33. It will receive packets with destination IP addresses to the other locally connected networks, and route according to its routing table. Access can be controlled with Firewall Rules, essentially creating different security zones.