Secure Computing SG300 User Manual page 101

When a packet is routed out the VLAN interface, the VLAN header is inserted and then
the packet is sent out on the underlying physical interface. When a packet is received on
the physical interface, it is checked for a VLAN header. If present, the router makes it
appear as though the packet arrived on the corresponding VLAN interface.
Once added, VLAN interfaces can be configured through the Network Setup >
Connections table as if they were additional physical network interfaces.
Note
Since the addition and removal of the VLAN header are performed in software, any
network device can support VLANs. Further, this means that VLANs should not be used
for security unless you trust all the devices on the network segment.
A typical use of VLANs with the SnapGear unit is to it to enforce access policies between
ports on an external switch that supports port-based VLANs.
In this scenario, only the switch and other trusted devices should be directly connected to
the LAN port of the SnapGear unit. The SnapGear unit and the switch are configured
with a VLAN for each port or group of ports on the switch. The switch is configured to
map packets between its ports and the VLANs. The SnapGear unit can then be
configured with firewall rules for the VLANs, and these rules are effectively applied to the
corresponding ports on the switch.
Note
Additionally, switch A on the SG560, SG565 and SG580 (but not the SG710 or SG710+)
supports port based VLANs. One benefit of this feature is that you are able to assign
individual functions to each of the ports on the switch, e.g. you might decide to use port
A2 to connect to a DMZ, and port A3 as a second Internet connection. See the section
entitled Port Based VLANs later in this chapter for details.
Adding VLANs
On the Network Setup page under the Connections menu, select VLAN from the pull-
down menu and click Add.
95
Network Setup