Proper "outside" interface configuration

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Proper "outside" interface configuration

L1 Bithead

Hello all!

I'm facing an issue which brings me to ask what the proper configuration should be for an outside interface.

 

Given the attached diagram and captures, do I have the correct outside interface (vlan.100) configuration?

 

diagramdiagram

 

  • Outbound traffic from the local users is being NATed to 194.204.1.6
  • Inbound web traffic from the Internet is being NATed to 194.204.1.10
  • Inbound FTP traffic from the Internet is being NATed to 194.204.1.11

 

Outbound traffic is not reaching Internet because the ARP entry for the default gateway (194.204.1.1) is incomplete in the firewall.

 

arp-incompletearp-incomplete

 

I think that is happening because the firewall is sourcing its ARP requests with the network IP (194.204.1.0).

 

capturecapture

 

Is that because of my outside interface configuration?

 

2025-04-15_13-52-51.jpg

 

Thanks!

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hello,

Either way would work, I usually go with the /32 myself for preference. Or you can just put the IP and no subnet mask.

 

Regards,

View solution in original post

5 REPLIES 5

Cyber Elite
Cyber Elite

Hello,

The only weird thing I saw was that you have 194.204.1.0/26 as an IP address (which its not). However check the routing as well to make sure 0.0.0.0/0 is going to 192.204.1.1 and internal traffic is going to the respective vlan. The traffic logs should show if the traffic is allowed etc.

 

Regards,


...you have 194.204.1.0/26 as an IP address...

Thank you for pointing that out, I inherited this configuration and couldn't understand why that is there, unless to make sure that the firewall will claim (from an ARP standpoint) all addresses in the 194.204.1.0/26 range. For instance, when the upstream router wants to deliver a packet for 194.204.1.10, it will ask "Who has 194.204.1.10?", and I thought this part of the interface configuration was responsible for making sure that the firewall replies "I am 194.204.1.10" without having to list all the addresses in that subnet.

Cyber Elite
Cyber Elite

Hello,

Just add the IP's of NAT policies to the interface is the ARP is send etc. Per your config they would be: 194.204.1.6, 194.204.1.10, and 194.204.1.11

 

Regards,


Just add the IP's of NAT policies to the interface...

Ok, like this?

 

194.204.1.6/26

194.204.1.10/26

194.204.1.11/26

 

Or should the subnet masks be /32?

Cyber Elite
Cyber Elite

Hello,

Either way would work, I usually go with the /32 myself for preference. Or you can just put the IP and no subnet mask.

 

Regards,

  • 1 accepted solution
  • 520 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!