2

We have a BT 21CN fibre connection into our firewall - it's just one patch cable into the X1 WAN port.

The connection has 5 public IP addresses.

For testing purposes, I need my machine, which is behind the firewall, to use one of those public IP addresses, which is not assigned to X1, as a gateway to the Internet. This is because we've set up special access rules for our default Internet IP address to one of our web servers somewhere else. There are also a few other times where this might be useful.

As it is, our firewall only knows that the X1 has one public WAN IP address. How do I go about telling it there are several WAN IP addresses, and how on earth can I then configure a new gateway on it which I can specify manually on my workstation?

I do, of course, want to leave the 'default' WAN gateway well alone as we have a network full of users using it.

Improve this question
1
  • 1
    Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 12, 2017 at 4:07

4 Answers 4

Reset to default
2

As others have stated there is not a need to configure any sub-interfaces on the SonicWALL. I am assuming your modem is already in bridge mode since you have a public IP address configured on the SonicWALL Internet facing interface, if this is not so this needs to be done.

There is nothing you need to do to announce those IPs from the SonicWALL because in bridge mode the SonicWALL is acting as an authoritative device of sort for them with your modem acting as the gateway.

The only thing that needs configured is a NAT policy mapping the desired public IP address to desired private IP address. The easiest way to do this is via the public server wizard which can be located on the top right corner of the web interface.

Step 1: Launch Wizards
Step 2: Select "Public Server Wizard"
Step 3: Specify Server Type and what ports you would like forwarded.
Step 4: Specify the private IP address of the server, and a friendly name to help you identify it in the ruleset.
Step 5: Specify the Public IP address you would like to use.
Step 6: Review the summary to ensure everything is correct, and apply your changes!

If you need to make changes down the line, you can see your NAT policy under Network > NAT Policies

This should have no operational impact, however with any change you should exercise discretion and play it safe by making the change within a downtime window to minimize any potential user impact.

http://documents.software.dell.com/sonicos/5.9/administration-guide/wizards/providing-public-access-to-an-internal-server/wizards-public-server-wizard?ParentProduct=850

Improve this answer
1

If you're OK with the workstation using a local IP address, and that getting translated to one of your static IP addresses at the SonicWALL, all you need to do is setup 1:1 NAT:

UTM: SonicOS Enhanced how to configure NAT Policies (SW7979)

You're basically just making two NAT rules, one for inbound to the spare IP address, and one for outbound from the local IP address.

Improve this answer
1
  • Links go bad over time, and Network Engineering is meant to archive questions and answers, so you should always include the relevant information from the link, too. Don't include only the link, or only the information. You should edit your question to include the general steps in order to accomplish the task. You are free to copy-and-paste or otherwise directly quote the content from the link if you give proper attribution.
    – Ron Maupin ♦
    Commented Mar 11, 2016 at 2:01
1

You could configure an interface , say X4, to be part of a DMZ zone and in Transparent Mode, as per this KB article from Dell:

Configuring an Interface (LAN, DMZ, etc.) in Transparent Mode in SonicOS Enhanced (SW5979)

Improve this answer
1
  • Links go bad over time, and Network Engineering is meant to archive questions and answers, so you should always include the relevant information from the link, too. Don't include only the link, or only the information. You should edit your question to include the general steps in order to accomplish the task. You are free to copy-and-paste or otherwise directly quote the content from the link if you give proper attribution.
    – Ron Maupin ♦
    Commented Mar 11, 2016 at 2:06
1

You can try one-to-one NAT, I'd start by putting one of the extra 5 IP addresses as subinterfaces on the X1 WAN and seeing if you can ping it from outside. If so, winner ;)

I don't know if its safe to test this on a live environment, I'd schedule downtime TBH.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.