1

I have 2 routers from the same ISP but different public IP that works with PPPoE and I need to connect both into the same firewall (Watchguard). Both PPPoE have the same user, password and VLAN, so I don't know how to do it. I tried to configure a switch with 2 access ports with different vlan (6 and 7) and a trunk port with both vlan tagged. The firewall port has both vlan tagged to and the pppoe configuration is correct, but I'm unable to get the public IP on the firewall interfaces with this configuration. Maybe PPPoE cannot be configured into tagged vlan or a trunk port?

This is the de schema:

enter image description here

And this is what I get into the Watchguard interface status:

enter image description here

Thank you.

Regards,

Improve this question
4
  • 1
    The question is very confusing. Maybe you can support your question with a simple network drawing about what you are trying to achieve...
    – Mario Jost
    Commented Feb 20, 2020 at 16:11
  • Placing a switch outside of the firewall puts you at risk, and it adds one more single point of failure. Simply run each ISP connection to the firewall. You seem to be overthinking this.
    – Ron Maupin ♦
    Commented Feb 20, 2020 at 17:53
  • Yes I know, but the problem is that I only have 2 interfaces: LAN and WAN. With LAN port 0 problems and complications, but with 2 WANs and one port, I don't know how to do it.
    – b4nerj3e
    Commented Feb 20, 2020 at 18:04
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 16, 2020 at 23:09

1 Answer 1

Reset to default
1

You need to use two WAN interfaces on the Watchguard and connect each router seperately. You cannot use tagged VLANs when the other end of the link isn't configured in the same way.

If the devices are spaced further apart and you need VLANs to splice that into your normal network, you can connect one VLAN for each ISP router untagged on each router uplink, tag them across your network and untag them towards the Watchguard using two interfaces. Very likely you can also configure a VLAN trunk to the WG and tag the "WAN" VLANs on both sides.

Improve this answer
5
  • Some switches support tag rewriting (translation), but yes, this is far more complicated.
    – Ricky
    Commented Feb 20, 2020 at 16:28
  • Hi, the ISP routers are connected to an HP Switch and each to an access port with an untagged VLAN (6 or 7). Then I have a trunk port with both VLAN tagged configured in the switch and in the Watchguard.
    – b4nerj3e
    Commented Feb 20, 2020 at 17:42
  • @b4nerj3e You need to make your question clearer on which setup works and which one doesn't. However, if everything is built in the exact same way it's possible that the ISP also uses the routers' MAC addresses for authentication.
    – Zac67 ♦
    Commented Feb 20, 2020 at 18:18
  • Right now I have a Sonicwall and each wan is connected to a different physical interface, and it works. And if I have enough free ports at Watchguard, I'm sure it will work, so the problem is to do it with 2 PPPoE wans in the same trunk port or if it's not possible.
    – b4nerj3e
    Commented Feb 20, 2020 at 18:38
  • @b4nerj3e It's possible but not likely that the PPPoE and VLAN combination is the problem - lots of ISP use that combination. You should check the VLAN on the switch whether you see the expected MAC addresses. Check the logs. Also, reduce complexity and try each WAN link separately. Then run a packet trace on the WG facing port.
    – Zac67 ♦
    Commented Feb 20, 2020 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.