im trying to route the Internet from our Datacenter to our Office over an AT&T ASE line (similar to an MPLS). At first I was going to just add the office subnets to the router in the datacenter and link the 2 sites that way. However, after talking to some of ya'll, I ended up linking them using a shared subnet that is on the ASE/MPLS network.

Everything is working properly for all of the Internal subnets but im not sure how to get the Internet to route through the connection as well. My end goal is to remove the WAN connection from our office and use the WAN from the datacenter via the ASE/MPLS.

Please take a look at the diagram I have attached of the setup so you can better understand what im talking about.

enter image description here

The datacenter network is, the office network is, and the network used to link the sites is There are more VLANs and networks, but if I can make it work on these I should be OK on the other ones. The switches that im using are Dell PowerConnects that can only do Layer2, so the Checkpoint 4400s that im using are handling the routes and are connected to the ASE line. There are 2 Checkpoints in the datacenter that are setup as a Cluster, with a VIP IP of

I have some routes on each side to handle the internal traffic. i.e. ip route and another one on the other side as ip route There are handling the Internals perfectly.

To share the internet through this connection, I was considering changing the default gateway on my Office Checkpoint from the WAN IP of our Office WAN to the interface on the other side of the ASE I would then create a NO_NAT rule for the internal subnets and then a regular NAT rule for the traffic to go out the WAN IP at the datacenter.

Is this an OK way of doing this? Currently, at the office, the default route on the checkpoint is pointed to the WAN connection at the office. I figured changing the default route would allow anything outside of the subnet to hit the other side and go from there.

Any help would be appreciated! Let me know if you think there is an error in my ways. Thanks!

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Feb 21, 2018 at 18:48

1 Answer 1


It is actually pretty simple. Only advertise the default route into your network from the router connected to the Internet. Any traffic destined to a network, not otherwise in the routing tables, will then be sent to your Internet router. Perform NAT on that router for traffic leaving your network. You don't need NO_NAT rules because you only NAT on the Internet router for traffic destined to the Internet.

  • So on my Checkpoint that is in the office, I would remove the WAN IP from the default route on there and change it to the IP of the Router in the datacenter that is actually routing the WAN traffic? That way everything would be going to the WAN router and if its not an internal subnet, it would go out the WAN connection. Is that what you're saying Ron? Thanks.
    – saleetzo
    Jan 16, 2018 at 22:03
  • No. You only define the default route on the Internet router, then advertise it into your routing protocol. You do not put it on any other router. Also, I don't seen the point of the firewall at the remote office because you should have the firewall at the Internet connection.
    – Ron Maupin
    Jan 16, 2018 at 22:06
  • Okay, I think I see what you are saying now. Right now we don't have another Layer 3 device at the office to handle routing so I was doing it on the firewall. Also, we still have a WAN connection coming in to the office until I can share the Internet from the datacenter so that is why the current default route on the office firewall is pointing to its WAN connection. You're right, there really isn't need for 2 of them. We initially tried to do all this through the site-to-site VPN between the 2 checkpoints, which didn't work properly. I'll look in to what routing protocols we use. Thanks ron.
    – saleetzo
    Jan 16, 2018 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.