Multiple VLAN on switch port

[ErrolDC]

** Same post is in PIX Forums **
I am trying to determine the best approach complete a task that I have set before me. I wanted to ping this community see what others would have to say.

I have a PIX 515E with 6 physical interfaces. One of these interfaces is responsible for firewalling/segmenting a network that is specifically reserved for building tenants of my company. The interface physically connects to a swithport on a 6506. The idea is to connect each of our tenants to a port the 6506 and segment them through vlans. Each tenant will be on a separate vlan. This seperates the tenants from each other and from our network, however, the PIX firewall will be their gateway so the PIX needs to reside on the same vlan as each tenant.

I am aware that the PIX I have only supports 10 total interfaces, which means got only got 4 interfaces to play with for VLAN stuff. However, I don't need the vlan information to route through the PIX. The vlan stuff can be stripped before the packet exits the interface physically connected to the switch. What I am interested is binding multiple VLANS to a single switch port so that all my tenant vlans can communicate with their gateway. Is this possible to do? Or is there another way I can do what I need to do?

Thanks for your thoughts.

 

[Parcival21]

Try to inform yourself about VLAN trunking. This might be what you are looking for...
bye,
busche

 

[ErrolDC]

Thanks for the reply.
I am already familiar with trunking. However, what I do not know is if the PIX supports ISL or the 802q.11 standard.
Also, is that the only way I can achieve what I am looking to do?

 

[vipergg]

I would think it would support 802.1Q seeing that is the defacto standard for trunking and ISL is a old Cisco proprietory technology.

 

[ErrolDC]

Thanks for all the responses.
Last question please. Is it possible to have an interface belong to more than one VLAN and it not require trunking and be totally transparent to the host connected to the interface/port? I do not need the host to be aware of the VLAN information. In this case, all I care about is the 6509 allowing every vlan to communicate with the VLAN that the PIX is in..

 

[lui3]

Why not make the 6509 the gateway? is it not L3 capable? I would setup point to point subnets on each tenant and terminate them on the 6509 ports assigning each ptp subnet to a different vlan. that would take care of the security issue. use access-lists to limit traffic between subnets. then just use the pix for what its meant for, firewalling/ids/vpn. dot1q trunking is possible with the pix however it would be better to use the switch for vlan layer2 related activities as that is what it was designed to do.

Good luck.

Lui3
CCNP,CCDA,A+/Net+
Cisco Wireless Specialization

 

[achindah]

The answer to your question is YES. Look up PVLANs. This will allow the interface of the PIX firewall to connect to a switch port that is configured for more multiple VLANs while the end host is connected to a port that is configured for a specific VLAN

Thanks for all the responses.
Last question please. Is it possible to have an interface belong to more than one VLAN and it not require trunking and be totally transparent to the host connected to the interface/port? I do not need the host to be aware of the VLAN information. In this case, all I care about is the 6509 allowing every vlan to communicate with the VLAN that the PIX is in..