I have a network with 5 locations. 4 locations are running Xfinity Fiber EVPL for connecting sites together. For Simplicity lets call them:
1. Main site
2. 2nd site
3. 3rd site
4. 4th site
The EVPL fiber uses VLAN's or CTAG's for routing between sites.
Main site = VLAN1
Main site wireless = VLAN101
2nd site = VLAN30
3rd site = VLAN40
4th site = VLAN50
All sites are OK to communicate with other sites. They are separated for routing purposes only not segregation.
Sites 2-4 all have Cisco SG300 switches. The uplink ports on the switches that connect to the Ciena devices (fiber modem/routers) are tagged with the VLAN according to their site.
The Ciena's are setup to route the 3 VLAN's back to the main site. The Ciena at the main site is plugged into a Cisco RV325. This router has a 14 port Gigabit switch built in. The RV325 is setup as each networks gateway as such:
Main site = 192.168.1.1
MS wireless = 192.168.101.1
2nd site = 192.168.3.1
3rd site = 192.168.6.1
4th site = 192.168.8.1
4 network wires are plugged into the RV325. 1 is for WAN (for the internet). 1 is for EVPL (traffic to and from 3 other sites). 1 is for Main site (local network that plugs into the first switch at the main site). 1 is for wireless POE switch (switch that only wireless AP's connect to. Uplink port tagged) All 4 sites internet traffic routes through the WAN at the main site.
At the main site everything is running on VLAN1 untagged except for the wireless switch. There are a total of 4 switches in the main site. 3 are Cisco SG300-52 and 1 Cisco SG200-8 (wireless). Lets call them:
So switch2 and switch3 are both plugged into switch1. Switch1 is plugged into RV325 untagged. WirelessSwitch is plugged into RV325 but it is tagged.
Right now everything is working fine. No dropped packets, no delays, it is great!
My question: So the client has decided they want to change the RV325 and put in something "better". More firewall features, SSL VPN, etc. I have been testing other products but the problems I am having is the routing of the VLANs. Here is how I have to change the scenario.
Since other firewall solutions do not have 14 port switches built in, I have to move wires. Here is how I am wiring it;
On new firewall, WAN port goes to WAN. LAN port goes to switch1. The EVPL from the Ciena now plugs into switch1. The WirelessSwitch also plugs into switch1. Now everything is going through switch1 to get to the new firewall and I am not able to communicate to any other VLAN. Even the wireless will not work. The internet works fine so I know the new firewall is setup semi-correctly at least.
Do I need to change the setup on switch1 somehow? I thought it would pass all tagged traffic no matter the VLAN, and the firewall/router would handle the rest. This isn't working so clearly my thought process is flawed. Should I change switch1 to layer3 and let it handle the routing of the VLANs? If so, would I setup the gateway IP's on switch1 or the new firewall?
Any help would be appreciated.