Firewall

[Badaz52]

Hi everyone,

 

At the moment we have an LA provided internet connection with smoothwall filtering. The smoothwall license is provided by the LA which means if we move away we lose smoothwall.

 

The new broadband provision I have been quoted for includes cloud filtering which is fine but to facilitate our wireless network I need something that can dish out DHCP addresses based on vlan membership, I use smoothwall and virtual interfaces for this but if I swapped it with say a Sonic wall TZ400 would this do the trick or is there a better solution?

 

Cheers!

[Jawloms]

You not got a Windows server on site?

[Badaz52]

You not got a Windows server on site?

 

I use a windows DHCP server to dish out IPs for the main network (VLAN 1) but have been using smoothwall to do the wireless networks that are vlanned off.

[Jawloms]

The Windows server can do all that though can't it?

[Badaz52]

The Windows server can do all that though can't it?

 

I didn't think it could be that clever lol, I'm assuming you create some policies then? how can it detect different vlans I see no options for that.

Edited February 5, 2019 by Badaz52

[Jawloms]

Assuming your switches are layer 3, you give each VLAN it's own IP, setup some DHCP helpers pointing at your Windows server, setup a scope for each range you want and you're away. Windows will see where the request is coming from and assign an IP from the appropriate scope. So long as your switches are setup, it's as easy as this;

 

https://thesolving.com/server-room/how-to-configure-a-multiscope-dhcp-server-to-work-with-vlans-on-windows-server-2012/

Edited February 5, 2019 by Jawloms

[Davit2005]

I didn't think it could be that clever lol, I'm assuming you create some policies then? how can it detect different vlans I see no options for that.

 

Apart from creating a DHCP scope for the vlans you don't need to do anything special on the DHCP server for this to work. What you will have to do on the smoothwall is add DHCP relay and then you might need to open DHCP ports between the Zones/Interfaces/vlans that have your DHCP server and WiFi traffic on. I suggest opening ports UDP 67 and 68 both ways. The other thing which may cause issues is if your windows DHCP server has a different gateway i.e. not routed on the Smoothwall.

 

I have similar setup in Home lab where Radius authenticates WiFi users and depending on their security group in AD they get put on different vlans via Radius. The DHCP server is running on Windows 2012 R2 seperated from all other vlans via the firewall.

Edited February 5, 2019 by Davit2005

[Badaz52]

Assuming your switches are layer 3, you give each VLAN it's own IP, setup some DHCP helpers pointing at your Windows server, setup a scope for each range you want and you're away. Windows will see where the request is coming from and assign an IP from the appropriate scope. So long as your switches are setup, it's as easy as this;

 

https://thesolving.com/server-room/how-to-configure-a-multiscope-dhcp-server-to-work-with-vlans-on-windows-server-2012/

 

We only have L2 switches, I'm guessing this is why I could never get it to work lol

[Wave9_Lee]

Hi Badaz,

 

You can do this with Sophos XG Firewall. if you don't need filtering etc, then this would be at a lower cost. Let me know if you need any more info.

 

cheers

 

Lee

[Badaz52]

Hi Badaz,

 

You can do this with Sophos XG Firewall. if you don't need filtering etc, then this would be at a lower cost. Let me know if you need any more info.

 

cheers

 

Lee

 

All I would need is a firewall with dhcp capabilities for different virtual interfaces thats it really no filtering. What kind of cost do you think I'd be looking at? I know I can get a Sonic wall TZ400 that would do this for about a grand but not sure if it would be good enough for the size of our network or whether I'd need to go for one of the higher models.

[Davit2005]

All I would need is a firewall with dhcp capabilities for different virtual interfaces thats it really no filtering. What kind of cost do you think I'd be looking at? I know I can get a Sonic wall TZ400 that would do this for about a grand but not sure if it would be good enough for the size of our network or whether I'd need to go for one of the higher models.

 

If you are just segregating for guest WiFi access 1Gb port on the firewall may well do the job to be honest. If you start setting up a whole load of vlans that need to be routed then you may want to consider a L3 switch with higher routing capability/resiliency for the Internal vlans and then have WiFi routed on the firewall.

Edited February 6, 2019 by Davit2005

[Wave9_Lee]

PM Sent

 

What size of school/connection are we looking at?

[Badaz52]

If you are just segregating for guest WiFi access 1Gb port on the firewall may well do the job to be honest. If you start setting up a whole load of vlans that need to be routed then you may want to consider a L3 switch with higher routing capability/resiliency for the Internal vlans and then have WiFi routed on the firewall.

 

So in smoothwall I configured 4 virtual interfaces on 1 physical card and had smoothwall dish out dhcp addresses dependant on which virtual interface they have been tagged with, I have 4 wireless networks at the moment but am going to reduce this down to 2.

[Davit2005]

So in smoothwall I configured 4 virtual interfaces on 1 physical card and had smoothwall dish out dhcp addresses dependant on which virtual interface they have been tagged with, I have 4 wireless networks at the moment but am going to reduce this down to 2.

 

I'm not familiar with Smoothwall and it has been 7 years since I last played with SonicWall, have you asked Smoothwall support about various options with regards DHCP relay?

 

It would still work if you had just your WiFi guest network being dealt IP addresses from firewall then you can be sure that you have no traffic from guests hitting the internal network at all. I did do this on the SonicWall years ago.

Edited February 6, 2019 by Davit2005