Configuring VLANs

Your UTM-1 appliance allows you to partition your network into several virtual LAN networks (VLANs). A VLAN is a logical network behind the UTM-1 appliance. Computers in the same VLAN behave as if they were on the same physical network: traffic flows freely between them, without passing through a firewall. In contrast, traffic between a VLAN and other networks passes through the firewall and is subject to the security policy. By default, traffic from a VLAN to any other internal network (including other VLANs) is blocked. In this way, defining VLANs can increase security and reduce network congestion.

For example, you can assign each division within your organization to a different VLAN, regardless of their physical location. The members of a division will be able to communicate with each other and share resources, and only members who need to communicate with other divisions will be allowed to do so. Furthermore, you can easily transfer a member of one division to another division without rewiring your network, by simply reassigning them to the desired VLAN.

The UTM-1 appliance supports the following VLAN types:

• Tag-based

  In tag-based VLAN you use one of the gateway’s ports as a 802.1Q VLAN trunk, connecting the appliance to a VLAN-aware switch. Each VLAN behind the trunk is assigned an identifying number called a “VLAN ID”, also referred to as a "VLAN tag". All outgoing traffic from a tag-based VLAN contains the VLAN's tag in the packet headers. Incoming traffic to the VLAN must contain the VLAN's tag as well, or the packets are dropped. Tagging ensures that traffic is directed to the correct VLAN.

Tag-Based VLAN

• Port-based

  Port-based VLAN allows assigning the appliance's LAN ports to VLANs, effectively transforming the appliance's four-port switch into up to four firewall-isolated security zones. You can assign multiple ports to the same VLAN, or each port to a separate VLAN.

  Port-based VLAN does not require an external VLAN-capable switch, and is therefore simpler to use than tag-based VLAN. However, port-based VLAN is limited by the number of appliance LAN ports.

Port-Based VLAN

• Virtual access point (VAP)

  In wireless UTM-1 models, you can partition the primary WLAN network into wireless VLANs called virtual access points (VAPs). You can use VAPs to grant different permissions to groups of wireless users, by configuring each VAP with the desired security policy and network settings, and then assigning each group of wireless users to the relevant VAP. For example, you could assign different permissions to employees and guests on the company's wireless network, by configuring two VAPs called “Guest” and “Employee” with the desired set of permissions.

  To use VAPs, you must enable the primary WLAN network.

  For more information on VAPs, see Overview.

• Wireless Distribution System (WDS) links

  In wireless UTM-1 models, you can extend the primary WLAN's coverage area, by creating a Wireless Distribution System (WDS). A WDS is a system of access points that communicate with each other wirelessly, without any need for a wired backbone. WDS is usually used together with bridge mode to connect the networks behind the access points.

  To create a WDS, you must add WDS links between the desired access points. For example, if your business extends across a large area, and a single access point does not provide sufficient coverage, then you can add a second access point and create a WDS link between the two access points.

  To use WDS links, you must enable the primary WLAN network.

  For more information on WDS links, see Overview.

The number of VLAN networks you can define depends on your UTM-1 series and model.

Supported Number of VLANs

For information on counting VAPs and WDS links, see Configuring a Wireless Network.

For information on the default security policy for VLANs, see Default Security Policy.