2

am a bit confused on how this "Secondary network IP address on a different subnet" work. http://www.watchguard.com/help/docs/wsm/xtm_11/en-US/index.html#cshid=en-US/networksetup/second_net_config_c.html

According to the diagram I see the following:

  1. Internal interface assigned with an IP of 10.10.10.254 and 172.16.1.254.
  2. Machines in the subnets 10.10.10.x and 172.16.1.x connected to this interface.

In other words, this is what I can visualize.
10.10.10.x subnet <--> Switch <--> Watchguard Interface
172.16.1.x subnet ------^

But how can a switch be connected to two different subnets or networks? Given we have 2 subnets, don't we need a router to route the traffic from this interface to the 2 subnets like in the following configuration?.

10.10.10.x subnet <--> Router <--> Watchguard Interface
172.16.1.x subnet ------^

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 4:15
2

Technically, the firewall would be the "router" in this case. Multiple subnets can coexist on one layer-2 broadcast domain. Each subnet will function as if the others aren't there.

  • Thanks for the reply. You mentioned "... can coexist on one layer-2 brodcast domain." But don't we have 2 broadcast domains here with both 10.10.10.255 and 172.16.1.255? From the literature it has devices from 10.10.10.x and the router has the IP 10.10.10.244 so I'm guessing it's a 10.10.10.1/24 network with 10.110.10.255 as the broadcast domain. Similarly for the 172.16.1.1/24 network with 17.16.1.255 as the broadcast. – user192702 Feb 1 '15 at 15:50
  • Okay just looked at the following URL. I guess what you are referring to is we can have multiple VLAN configured on a switch (sorry was thinking of a simple switch before without VLAN). But per Figure 4, the Layer 3 switch (or I guess the Watchguard device in our case) needs to have 2 ports (1 port connected to the 10.10.10.1/24 VLAN and 1 port connected to the 172.16.1.1/24 VLAN). But from the Watchguard documentation it looks like they are suggesting the same interface configured with both networks? kb.meraki.com/knowledge_base/… – user192702 Feb 1 '15 at 16:00
  • VLANs are the modern way to handle it -- which does create different broadcast domains. Each subnet has it's own (layer-3 / IP) broadcast address, but at layer-2 (ethernet) there's only one (FF:FF:FF:FF:FF:FF). – Ricky Beam Feb 2 '15 at 1:26
  • Okay so does that mean I can use one port on the Watchguard to connect to a port on subnet 1, and run a cable from a second port on subnet 1 to a port on subnet 2, given both subnet would have the same layer 2 broadcast domain? This way I can save on the number of ports used on the Watchguard as there are more ports on the switch. – user192702 Feb 2 '15 at 12:45
  • No, you would use one cable between the Watchguard and the switch for both subnets. Both L3 subnets share the same L2 topology. – YLearn Feb 2 '15 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.