When your organization wants to divide a LAN into separate
virtual LANs (VLANs) to keep traffic and policies for different
departments separate, you can logically group Layer 2 hosts into
VLANs and thus divide a Layer 2 network segment into broadcast domains.
For example, you can create VLANs for the Finance and Engineering
departments. To do so, Configure
a Layer 2 Interface, Subinterface, and VLAN.
The firewall acts as a switch to forward a frame with an Ethernet
header containing a VLAN ID, and the destination interface must
have a subinterface with that VLAN ID in order to receive that frame
and forward it to the host. You configure a Layer 2 interface on
the firewall and configure one or more logical subinterfaces for
the interface, each with a VLAN tag (ID).
In the following figure, the firewall has four Layer 2 interfaces
that connect to Layer 2 hosts belonging to different departments
within an organization. Ethernet interface 1/3 is configured with subinterface
.1 (tagged with VLAN 10) and subinterface .2 (tagged with VLAN 20),
thus there are two broadcast domains on that segment. Hosts in VLAN
10 belong to Finance; hosts in VLAN 20 belong to Engineering.
In this example, the host at MAC address 0A-76-F2-60-EA-83 sends
a frame with VLAN ID 10 to the firewall, which the firewall broadcasts
to its other L2 interfaces. Ethernet interface 1/3 accepts the frame
because it’s connected to the host with destination 0C-71-D4-E6-13-44
and its subinterface .1 is assigned VLAN 10. Ethernet interface
1/3 forwards the frame to the Finance host.