Proper "outside" interface configuration

[relayer]

Hello all!

I'm facing an issue which brings me to ask what the proper configuration should be for an outside interface.

Given the attached diagram and captures, do I have the correct outside interface (vlan.100) configuration?

diagram

• Outbound traffic from the local users is being NATed to 194.204.1.6
• Inbound web traffic from the Internet is being NATed to 194.204.1.10
• Inbound FTP traffic from the Internet is being NATed to 194.204.1.11

Outbound traffic is not reaching Internet because the ARP entry for the default gateway (194.204.1.1) is incomplete in the firewall.

arp-incomplete

I think that is happening because the firewall is sourcing its ARP requests with the network IP (194.204.1.0).

capture

Is that because of my outside interface configuration?

Thanks!

[OtakarKlier]

Hello,

The only weird thing I saw was that you have 194.204.1.0/26 as an IP address (which its not). However check the routing as well to make sure 0.0.0.0/0 is going to 192.204.1.1 and internal traffic is going to the respective vlan. The traffic logs should show if the traffic is allowed etc.

Regards,

[relayer]

---

...you have 194.204.1.0/26 as an IP address...

---

Thank you for pointing that out, I inherited this configuration and couldn't understand why that is there, unless to make sure that the firewall will claim (from an ARP standpoint) all addresses in the 194.204.1.0/26 range. For instance, when the upstream router wants to deliver a packet for 194.204.1.10, it will ask "Who has 194.204.1.10?", and I thought this part of the interface configuration was responsible for making sure that the firewall replies "I am 194.204.1.10" without having to list all the addresses in that subnet.

[OtakarKlier]

Hello,

Just add the IP's of NAT policies to the interface is the ARP is send etc. Per your config they would be: 194.204.1.6, 194.204.1.10, and 194.204.1.11

Regards,

[relayer]

---

Just add the IP's of NAT policies to the interface...

---

Ok, like this?

194.204.1.6/26

194.204.1.10/26

194.204.1.11/26

Or should the subnet masks be /32?

[OtakarKlier · Accepted solution]

Hello,

Either way would work, I usually go with the /32 myself for preference. Or you can just put the IP and no subnet mask.

Regards,