Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Multi Gateway

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Multi Gateway

L3 Networker

Hello,

I need to install a PA200 for a internet breakout. Since i can't change the IP Subnet, I tough to change the default gw to the PA and use the PA as a router for traffic to the WAN (same subnet). But my problem is now that traffic comming from the wan to the client is comming from 192.168.1.1 -> to the pc 192.168.1.50 -> to the PA 192.168.1.5 -> to the WAN Router 192.168.1.1 dosn't work since the firewall dosn't allow that.

Isn't there a way to use icmp redirect so the PA200 is only working as a router for that kind of traffic?

8 REPLIES 8

L4 Transporter

So are you trying to stick the the PA between your current gateway and your network?

Excatly,

I tough I could just let the PA Reroute the Traffic, but then I found out that incomming Traffic (from WAN) begins to loop since the PA dosn't do a icmp redirect. Isn't there a Trick? Or I add a router or try to use the network switch as default GW.

Question is would it work like this?

Guess not I tough with Virtual Wire I can't route Traffic?

L4 Transporter

What's the difference between WAN and Internet?

WAN=Wide Area Network from the Company

Internet=Local Breakout for http/https/vpn...

L4 Transporter

I wonder if Policy Based Forwarding would fit the bill here:

It's kind of the same principle. Your have two "ISPs" but you want some of the traffic to go one way, and some of the traffic the other way and be transparent to the client.

You might have to reach out to support on this one. I'm sure there's way to do it, either by PBF or changing your routing table around.

PBF would only work if both gateways are behind the firewall.

Well let me think about that....i can't connect the same ip subnet to different ports or?

Why do you need to use 2 routers? Cant you consolidate the WAN and INET connections on the PA200?

I really am having a difficult time understanding this deployment. If you have two routers involved you need to make sure the routing table is correct to send internal traffic to the WAN and anything else to the INET. You may have some NAT considerations as well.

Steve Krall

I dont get the drawings.

Could you provide us with a drawing of how it looks right now (without the PAN) and which network is used on which interface (along with which ip each interface on each box have)?

If we assume you have a setup similar to:

WAN (192.168.0.0/24) [192.168.0.1] <WAN-ROUTER> [192.168.1.254] (192.168.1.0/24 (L2-SWITCH)) [192.168.1.5] <CLIENT>

Then you should be fine with just plugin your PA200 on the switch between WAN-ROUTER and CLIENT and give the PAN unit following settings:

192.168.1.253/24, defgw [IP of ISP-ROUTER]

Then in your clients you setup a routing table similar to:

0.0.0.0/0 nexthop 192.168.1.253
192.168.0.0/24 nexthop 192.168.1.254
192.168.1.0/24 directly attached

and voila... no need for icmp redirects and shit like that 🙂

  • 3921 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!