0

We have a situation that I'm not sure how to proceed correctly.

This location is currently utilizing two different firewalls - a Sophos XG 310 and a Sonicwall NSA 3500. The way this was originally configured, a small switch was put in place before the firewalls, with one ISP connection coming into the switch, then one connection from the switch going to each firewall. They have one public IP from their ISP going to the Sonicwall, and one public IP (for the same ISP connection) going to the Sophos.

I am wanting to move the public IP that is currently on the Sonicwall to the Sophos without disrupting the flow of traffic to the ISP. They have several services that use the public IP that is currently on the Sonicwall.

How can I move the connection from the Sonicwall to the Sophos as a second interface for the same ISP and allow communcation for the services to work properly?

enter image description here

Best description I can come up with is that ...120 has a NAT for connecting to Remote Desktop Gateway with ...120:45678. I want to move the ...120 interface from the Sonicwall on the left to the ...121 Sophos on the right. Do I create a second interface on the Sophos, then create the NAT and firewall rules? Seems off to me to have two different public IP's on two different interfaces from the same ISP pool. There are even more services on the old Sonicwall in addition to the one I described, but trying to keep this as simple as possible.

6
  • We need more information in order to help you. Please edit your question to include a simple network diagram, along with the configurations of relevant devices.
    – Ron Trunk
    Commented Apr 28, 2021 at 14:43
  • Edited with information requested.
    – me55enger
    Commented Apr 28, 2021 at 15:43
  • 1
    "I am wanting to move the public IP that is currently on the Sonicwall to the Sophos without disrupting the flow of traffic to the ISP." Any such switchover will disrupt traffic for a period of time.
    – Ron Maupin
    Commented Apr 28, 2021 at 16:41
  • Sorry, poor wording. Was thinking more along the lines of the services being moved from Sonicwall to Sophos actually working when moved to the Sophos. I realize there will be a disruption when actually moving the connection over.
    – me55enger
    Commented Apr 28, 2021 at 17:05
  • I don't know anything about Sophos devices, but @Rais is correct: if you were moving it the other way (to the SonicWALL) you can't have two interfaces on the same subnet, but you can utilize 2 IPs on the same subnet for NAT and Firewall rules - perhaps the Sophos is the same. So just make a new NAT/Firewall rule using the .120 IP. On a SonicWALL you just create Address Objects in the WAN Zone and use them like the ones for the WAN IP itself. (And if they are different subnets, eg. both /32, then you can use separate interfaces since the device won't see a conflict that way).
    – PSaul
    Commented May 1, 2021 at 4:34

2 Answers 2

2

A firewall may not allow two interfaces using IP addresses from the same subnet. May be you can use a secondary address on the same interface.

0

For this, you would need to create a Static Route to redirect all the traffic going from the devices behind the Sonicwall towards the XG, I would recommend you to connect to create a new interface in your XG and in the Sonic Wall, (avoid sending back the traffic to the switch where both devices are connected to LAN side) so in the Sonicwall you can create the Static route sending all the traffic directed to the internet via the Sophos XG Firewall, then in the XG just create a SDWAN rule for saying all traffic coming from the new Interface created in the XG, for the specific subnets (Subnets behind the Sonicwall) go out via the WAN interface of the XG.

Create the NAT rule for this traffic and a Firewall Rule and that should be it. I would also create a SSL/TLS exception for this traffic while you’re testing.

Regards,

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.