vlan - Configure 802.1Q VLANs (Virtual LANs)
[1] vlan [(admin | antivirus | peer | file | mon | rweb | web) [<vlan-id>]]
[2] vlan [external [(none | <vlan-id>)]]
This command allows you to define 802.1Q VLANs (Virtual LANs). VLANs allow you to increase network security by isolating different types of traffic crossing the same physical NIC (Network Interface Card) within separate Virtual LANs (VLANs). When VLANs are used, an associated virtual NIC is implicitly defined for each configured VLAN.
A VLAN is identified by a <vlan-id> (VLAN identifier). This is a numeric value between 0 and 4095. By default, all access types are associated with VLAN 0. Different access types may use the same VLAN. This vlan command allows you to define VLANs and associate them with different access types. The first usage form allows you to define a VLAN on the internal network interface and associate it with an access type. Valid access types are as follows:
• admin: access from remote administrators (SSH and Administration GUI). You can use this VLAN to connect privileged workstations with administration rights.
• antivirus: access to the antivirus service from external systems. You can use this VLAN to isolate all requests to and responses from the embedded antivirus.
• peer: access to and from peer appliances. You can use this VLAN to connect all peer appliances.
• file: access to file servers (FTP, TFTP and SFTP). You can use this VLAN to connect file servers.
• mon: monitoring (SNMP) access to and from SNMP managers. You can use this VLAN to connect monitoring servers.
• rweb: access to backend web servers (and/or web application servers). You can use this VLAN for other servers requiring the same security level as web servers.
• web: web access from transparent and non-transparent users. You can use this VLAN for all users requiring access to the Internet.
Note that when VLANs are used on the internal network interface, the native internal network interface (i.e. internal) is no longer available. To use VLANs on the internal network interface, you must first activate the vlan mode using the mode command.
The external network interface is associated with a single type of access: access to the external, untrusted network (usually the Internet). However, it can also use an 802.1Q-tagged VLAN, mainly to connect the appliance to a WAN or ISP provider whose network terminal requires an 802.1Q-tagged VLAN. This is particularly useful for PPPoE connectivity when the ISP requires PPPoE traffic to be carried over a specific VLAN. The second [2] usage form of this command allows you to configure 802.1Q VLAN usage on the external network interface. If VLAN tagging is not required, specify the none keyword instead of the <vlan-id>.
apply(1), ip(1), mode(1)
CacheGuard Technologies <www.cacheguard.com>
Send bug reports or comments to the above author.
Copyright (C) 2009-2026 CacheGuard Technologies - All rights reserved