topic Re: setting up multiple internet connections in General Topics

setting up multiple internet connections

gnesper — Fri, 03 May 2024 10:50:18 GMT

Hi everyone. I have a PA-220 firewall. It is currently connected via interface 1/8 to an internet connection that I will soon have to discontinue, and which I will call GW1 here.
At the same time I activated a new internet connection that I will call GW2, connected to interface 1/7 of the firewall.
I would like to understand, before disconnecting the GW1 from the 1/8 interface, whether I have correctly performed all the configurations for the GW2 connection.
Via CLI, with the command "ping source ip_gw2 host 8.8.8.8 this cannot reach it.
If instead I try to execute the command "ping source ip_gw1 host 8.8.8.8 this responds correctly. Could it be a problem as a rule? Or is the firewall not able to support two different internet connections at the same time? thanks

Re: setting up multiple internet connections

rmfalconer — Fri, 03 May 2024 16:16:13 GMT

It can support multiple internet connections.

Do you have routing set up to use GW2?

Can you ping the next hop on GW2 sourced from 1/7? If you don't have a route to go to the next hop on GW2, then a ping to 8s sourced from there won't work.

Re: setting up multiple internet connections

gnesper — Sat, 04 May 2024 06:15:58 GMT

I created a second virtual router and assigned the 1/7 GW2 interface to it. In the statitc routes tab I entered the public IP provided by the ISP.

Re: setting up multiple internet connections

gnesper — Sun, 05 May 2024 21:27:48 GMT

I'm starting to think that the interface used for the second ISP is configured correctly despite the ping problems.

But I wonder...why does the command "ping source ip_gw2 host 8.8.8.8" get no response (neither lost packets nor successful packets) while the command "ping source ip_gw2 host www.google.com" gets responses instead?

Re: setting up multiple internet connections

gnesper — Mon, 06 May 2024 06:52:25 GMT

I can also ping 8.8.4.4. While the ping towards 8.8.8.8 remains stationary:

Re: setting up multiple internet connections

rmfalconer — Mon, 06 May 2024 14:55:16 GMT

That is odd. If you do a traceroute, does it even get to the first hop?

Re: setting up multiple internet connections

gnesper — Tue, 07 May 2024 14:58:34 GMT

consider that now I have both ISPs connected to the firewall.

Could you tell me the command to try traceroute with the second isp?

Re: setting up multiple internet connections

rmfalconer — Tue, 07 May 2024 15:22:02 GMT

It's the same as ping, traceroute source x.x.x.x host 8.8.8.8

Re: setting up multiple internet connections

gnesper — Tue, 07 May 2024 16:19:32 GMT

this is the result.

Please note that at the firewall I set 8.8.8.8 as the first DNS and 8.8.4.4 as the second DNS.

If I reverse it then I can ping 8.8.8.8 but no longer 8.8.4.4 🙂

Re: setting up multiple internet connections

rmfalconer — Tue, 07 May 2024 16:24:37 GMT

Do you have the same results with the other ISP?

Re: setting up multiple internet connections

OtakarKlier — Tue, 07 May 2024 19:20:15 GMT

Hello,

What do the traffic logs show? Is icmp allowed out that interface? Is eth 1/7 in the proper zone?

Regards,

Re: setting up multiple internet connections

gnesper — Tue, 07 May 2024 20:30:04 GMT

with the other ISP the traceroute and ping are OK:

Re: setting up multiple internet connections

gnesper — Tue, 07 May 2024 20:48:57 GMT

1/7 is in an untrust zone, similar to 1/8.
I think icmp is allowed since in the security policies in the application tab I set "any"

Re: setting up multiple internet connections

OtakarKlier — Tue, 07 May 2024 20:51:37 GMT

Hello,

On the new ISP interface, put in a specific route to something on the internet that is not required by the general users, ie you can use googles dns ip 8.8.8.8 if the other networks dont rely on it. Since its a specific route, it will take precedence over the 0.0.0.0/0 path.

Regards,

Re: setting up multiple internet connections

gnesper — Tue, 07 May 2024 20:58:28 GMT

guys I just discovered something...it seems that 1/8 is not able to ping the DNS set on the firewall (8.8.8.8 and 8.8.4.4 in fact). If I set only one DNS, for example 1.1.1.1, 1/8 magically starts to ping both 8.8.8.8 and 8.8.4.4. Obviously don't ping 1.1.1.1 anymore. Is this normal behavior?