Correct IP setting when two firewalls connected to one ISP.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Correct IP setting when two firewalls connected to one ISP.

L4 Transporter

We have two PA's connecting to one ISP. One is just being set up.

 

The ISP is "10.10.10.0/27"

Route is "10.10.10.5"

 

Is it correct to have both firewall external vlan interfaces as such

 

FW1 "10.10.10.99/27"

FW2 "10.10.10.122/27"

 Vlan 140

 

Vlan.jpg

 

 

 

And for the NAT

 

NAT.jpg

 

 

FW1 Main Nat "10.10.10.99/27"

FW2 Main Nat "10.10.10.122/27"

 

 

 

 

I ask, because the new firewall is logging packets for the old firewall. I am seeing "x.x.x.99" on the firewall with VIP "x.x.x.122"

 

monitor.jpg

 

 

 

11 REPLIES 11

Cyber Elite
Cyber Elite

- If your ISP's subnet is 10.10.10.0/27 , you have usable IP addresses 10.10.10.1 to 10.10.10.30, so your firewalls would need to have an IP in that range

- your vlans are untagged, you'll want to tag them and use proper vlans on your switches to prevent having one giant, and insecure broadcast domain

 

are there any other nat rules? it's possible your old firewall has taken ownership of all the IP's in that subnet if there's a NAT policy that allows it

Tom Piens
PANgurus - (co)managed services and consultancy

The IP's were just an obscured example.

 

Both have the same "/27"  on the interface and is that correct? 

Neither firewall has overlapping NAT IP addresses. the NAT addresses are x.x.x.y/27

 

 

I have the VLANS tagged on the aggregate interface, I assume that is sufficient and does not need tagged on the VLAN aswell. The switches are VLANED.

 

ae2.jpg

 

 

 

 

It all seems to be working,

 

It's just the loggs showing IP's from the other firewall that are the concern.  There's a 3rd Device on that subnet that also connects to the ISP, I don't see it at all in the loggs.

 

 

Hello,

Are you running active/passive or active/active? A/P doesnt need an IP for each firewall as they are shared between the two.

 

Regards,

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!