I have two separate networks: a data network and a VoIP network. The data network has a sonicwall tz210 on it between our network and our ISP. We just installed a separate VoIP network connected via a router to a different ISP. I need to connect the data network to the VoIP network only for administration of the VoIP server and control of the phones (app that runs on the desktop to control the phone). No call traffic will go over the data network. I am not quite sure how to setup the sonicwall to do this properly. below is a our setup and criteria for the setup

DATA network VoIP network

VoIP network has 52 port managed switch and router installed by telephone vendor connected to FIOS (5 static IPs, using

DATA network has managed switches connected to a sonicwall tz210 then to cable modem->internet. x0 LAN, x1 wan (we will be moving the data network to use the FIOS on one of the other static IPs.)

I would like to use x2 to connect to the VoIP network so that only traffic bound for goes out x2. and all other traffic goes out x1. Each user will need their PC (on DATA) to see their phone (on VoIP) as well as I will need to be able to connect to the VoIP server (on VoIP).

on DATA there is a windows server running DHCP (sonicwall DHCP is disabled). On VoIP the router there is giving out IP to the phones via DHCP. so i need DHCP servers not to interfere with each other. unfortunately our phone vendor in not familiar with the sonicwalls. Any help would be appreciated. Thanks.


  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 17, 2017 at 5:00

1 Answer 1


Your question doesn't list any specific IPs so I'm just going to make some assumptions, change them as needed. You can do what you want, DHCP is broadcast only within the local subnet (won't be passed by a router unless you configure specific options to do so).



X0 = Data LAN (let's say - connects to Data switch
X1 = WAN
X2 = VoIP (new)

Telephone Vendor Router:

port0 = Voice LAN (let's say - connects to VoIP switch
port1 = WAN

On the SonicWALL, configure:

Configure X2 on the SonicWALL with a free IP on the VoIP subnet, let's say: If the vendor controls this subnet ask them for a free IP, otherwise do an IP Scan.

Under Network | PortShield Group, edit X2 and ensure it is Unassigned (not assigned to X1). Then under Network | Interfaces, edit X2. Assign it to the LAN zone (assuming you trust the VoIP traffic - if you don't then use DMZ and you will need to create Firewall rules; choose LAN if you're unsure, to start). Set it for a Static IP, configure the IP, and other settings as desired.

Note: A route will automatically be created under Network | Routing (from Any to X2 Subnet, for Any Service).

If you selected X2 Zone = LAN the Firewall rules will already be created (assuming Interface Trust is enabled for the LAN zone, which it is by default). If you set X2 Zone = DMZ you will need to go to Firewall | Access Rules. Create or edit rule from LAN > DMZ, and DMZ > LAN for the X0 and X2 interface (I would suggest keeping things wide open, Any/Any/Any, during testing and then tighten up after if needed).

Connect X2 to the VoIP switch.

On the Phone Router:

NOW: you or the Phone Vendor will need to create a route on the other router. No IP or interface needs to be configured. The route will need to be:

Gateway:   (or whatever IP you assigned to X2)
Metric: 10 (or as needed)
[All services, if it asks. Interface is whatever interface is the "lan" interface on that device. Hopefully they know how to configure their own device]

If you were testing with a PC connected to the VoIP network (with a 172.21.1.x IP) the Windows route command would be:

route add mask

Depending on the config of the Voice Router there may be firewall polices that need to be created, but hard to say - I suspect not.


Anything on your Data LAN will have a default gateway of the SonicWALL - and the SonicWALL has an interface on the VoIP network so can pass packets along. Anything on the Void Network will have a default gateway of the Phone Router and that router now has a route pointing to the Data LAN via the IP you assigned to the X2 interface, so packets can travel back.

  • Thanks for the advice The issue now is that in the Port shielding group page x2 is labeled independent and the configured button is greyed out
    – LBC
    Mar 23, 2017 at 20:27
  • Try Disabling the port, then changing it. Also ensure that no other ports are linked to X2. On some models ports have defined roles (eg. X0/LAN, X1/WAN) so X2 may be DMZ, which is fine for what you want to do. If nothing else is linked to it and you can't change it, see if you can configure the interface (under Network | Interfaces, click Show PortShield Interfaces so all interfaces show up). Alternatively: use X3 or X4.
    – PSaul
    Mar 24, 2017 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.