Citrix Systems 4.2 14.5. Hardware Firewall

Chapter 14. Network Setup
164
2. VLAN 201 is used to route untagged private IP addresses for pod 1, and pod 1 is connected to
this layer-2 switch.
interface range ethernet all
switchport mode general
switchport general allowed vlan add 300-999 tagged
exit
The statements configure all Ethernet ports to function as follows:
• All ports are configured the same way.
• All VLANs (300-999) are passed through all the ports of the layer-2 switch.
14.4.2. Cisco 3750
The following steps show how a Cisco 3750 is configured for pod-level layer-2 switching.
1. Setting VTP mode to transparent allows us to utilize VLAN IDs above 1000. Since we only use
VLANs up to 999, vtp transparent mode is not strictly required.
vtp mode transparent
vlan 300-999
exit
2. Configure all ports to dot1q and set 201 as the native VLAN.
interface range GigabitEthernet 1/0/1-24
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 201
exit
By default, Cisco passes all VLANs. Cisco switches complain of the native VLAN IDs are different
when 2 ports are connected together. That’s why you must specify VLAN 201 as the native VLAN on
the layer-2 switch.
14.5. Hardware Firewall
All deployments should have a firewall protecting the management server; see Generic Firewall
Provisions. Optionally, some deployments may also have a Juniper SRX firewall that will be the default
gateway for the guest networks; see Section 14.5.2, “External Guest Firewall Integration for Juniper
SRX (Optional)”.
14.5.1. Generic Firewall Provisions
The hardware firewall is required to serve two purposes:
• Protect the Management Servers. NAT and port forwarding should be configured to direct traffic
from the public Internet to the Management Servers.
• Route management network traffic between multiple zones. Site-to-site VPN should be configured
between multiple zones.