am a bit confused on how this "Secondary network IP address on a different subnet" work. http://www.watchguard.com/help/docs/wsm/xtm_11/en-US/index.html#cshid=en-US/networksetup/second_net_config_c.html

According to the diagram I see the following:

  1. Internal interface assigned with an IP of and
  2. Machines in the subnets 10.10.10.x and 172.16.1.x connected to this interface.

In other words, this is what I can visualize.
10.10.10.x subnet <--> Switch <--> Watchguard Interface
172.16.1.x subnet ------^

But how can a switch be connected to two different subnets or networks? Given we have 2 subnets, don't we need a router to route the traffic from this interface to the 2 subnets like in the following configuration?.

10.10.10.x subnet <--> Router <--> Watchguard Interface
172.16.1.x subnet ------^

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11 '17 at 4:15

Technically, the firewall would be the "router" in this case. Multiple subnets can coexist on one layer-2 broadcast domain. Each subnet will function as if the others aren't there.

  • Thanks for the reply. You mentioned "... can coexist on one layer-2 brodcast domain." But don't we have 2 broadcast domains here with both and From the literature it has devices from 10.10.10.x and the router has the IP so I'm guessing it's a network with as the broadcast domain. Similarly for the network with as the broadcast.
    – user192702
    Feb 1 '15 at 15:50
  • Okay just looked at the following URL. I guess what you are referring to is we can have multiple VLAN configured on a switch (sorry was thinking of a simple switch before without VLAN). But per Figure 4, the Layer 3 switch (or I guess the Watchguard device in our case) needs to have 2 ports (1 port connected to the VLAN and 1 port connected to the VLAN). But from the Watchguard documentation it looks like they are suggesting the same interface configured with both networks? kb.meraki.com/knowledge_base/…
    – user192702
    Feb 1 '15 at 16:00
  • VLANs are the modern way to handle it -- which does create different broadcast domains. Each subnet has it's own (layer-3 / IP) broadcast address, but at layer-2 (ethernet) there's only one (FF:FF:FF:FF:FF:FF).
    – Ricky
    Feb 2 '15 at 1:26
  • Okay so does that mean I can use one port on the Watchguard to connect to a port on subnet 1, and run a cable from a second port on subnet 1 to a port on subnet 2, given both subnet would have the same layer 2 broadcast domain? This way I can save on the number of ports used on the Watchguard as there are more ports on the switch.
    – user192702
    Feb 2 '15 at 12:45
  • No, you would use one cable between the Watchguard and the switch for both subnets. Both L3 subnets share the same L2 topology.
    – YLearn
    Feb 2 '15 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.