External IPs with two ISPs

[oschuler]

Dear all,

We have a special setup on our external firewall interfaces. There are two different Internet lines from two different ISPs:

The yellow line (ISP b) indiaces the main Internet line. The green one is currently only used for outgoing e-mails using the "main" IP address 212.x.x.6. Now we would like to activate an additional IP range assigned by our ISP a: 212.x.x.96/28. We would like to use it the same way as the external IP addresses in the subnet of ISP b. The public IPs should be "assigned" to the firewall and it should be possible to NAT from 212.x.x.96/28 to internal IPs. Of course outgoing SNAT should work as well for traffic we policy route through that ISP.

Can you please give us some hints how we could implement this additional IP range? Do we need to create a loopback interface for that?

Thanks,

Oliver

[mikand]

Sounds like PBF (Policy Based Forwarding) could be the solution for your case:

This way you can setup so (for example) web-browsing will function through ispA incase ispB goes down.

Edit:

This one should be helpful aswell:

[oschuler]

Thank you mikand. The two docs are pretty interesting and I'll study them carefully to setup a proper redundancy. The issue I posted is another one. On ISP "a" (green part in the drawing) we have two different IP subnets available:

Subnet 1:

• Subnet ID: 212.x.x.4/30
• Default Gw: 212.x.x.5 (ISP a router)
• 212.x.x.6 is assigned to the firewall

Subnet 2:

• Subnet ID: 212.x.x.96/28
• Default Gw: none
• the whole host range can be assigned to the firewall, that is 212.x.x.97 - 212.x.x.110

On our old firewall we had the 2nd subnet assigned to a DMZ zone. The servers there had public IP addresses configured on their interfaces and the firewall routed the traffic between Subnet 1 and 2. Now with the new firewall we changed that. The IP addresses of the 2nd subnet should now be owned by the firewall and NAT to private IP addresses shall be performed where necessary. How do we configure this 2nd subnet to the PA firewall properly? In theory we can't just use the default gateway 212.x.x.5 from subnet 1 as it's in another subnet... Do we have to setup a loopback interface and assign the firewall one IP address like 212.x.x.97/28 so it can perform proper routing?

Thanks,

Oliver