External IPs with two ISPs

Showing results for 
Show  only  | Search instead for 
Did you mean: 

External IPs with two ISPs

L4 Transporter

Dear all,

We have a special setup on our external firewall interfaces. There are two different Internet lines from two different ISPs:


The yellow line (ISP b) indiaces the main Internet line. The green one is currently only used for outgoing e-mails using the "main" IP address 212.x.x.6. Now we would like to activate an additional IP range assigned by our ISP a: 212.x.x.96/28. We would like to use it the same way as the external IP addresses in the subnet of ISP b. The public IPs should be "assigned" to the firewall and it should be possible to NAT from 212.x.x.96/28 to internal IPs. Of course outgoing SNAT should work as well for traffic we policy route through that ISP.

Can you please give us some hints how we could implement this additional IP range? Do we need to create a loopback interface for that?




L6 Presenter

Sounds like PBF (Policy Based Forwarding) could be the solution for your case:

This way you can setup so (for example) web-browsing will function through ispA incase ispB goes down.


This one should be helpful aswell:

Thank you mikand. The two docs are pretty interesting and I'll study them carefully to setup a proper redundancy. The issue I posted is another one. On ISP "a" (green part in the drawing) we have two different IP subnets available:

Subnet 1:

  • Subnet ID: 212.x.x.4/30
  • Default Gw: 212.x.x.5 (ISP a router)
  • 212.x.x.6 is assigned to the firewall

Subnet 2:

  • Subnet ID: 212.x.x.96/28
  • Default Gw: none
  • the whole host range can be assigned to the firewall, that is 212.x.x.97 - 212.x.x.110

On our old firewall we had the 2nd subnet assigned to a DMZ zone. The servers there had public IP addresses configured on their interfaces and the firewall routed the traffic between Subnet 1 and 2. Now with the new firewall we changed that. The IP addresses of the 2nd subnet should now be owned by the firewall and NAT to private IP addresses shall be performed where necessary. How do we configure this 2nd subnet to the PA firewall properly? In theory we can't just use the default gateway 212.x.x.5 from subnet 1 as it's in another subnet... Do we have to setup a loopback interface and assign the firewall one IP address like 212.x.x.97/28 so it can perform proper routing?



  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!