2

I came across a network setup in this way:

  1. Cisco device provided by the ISP serving as a bridge between the fibre line and the LAN.
  2. Cable coming out from port eth0 of the Cisco above going to a layer2 switch.
  3. 2 firewalls connected to this switch both with WAN interface setup using the same public IP range/subnet 255.255.255.240.

Although I can't see any overlapping NAT rules on the two firewalls, meaning that each individual public IP is used in one firewall or the other, my fear is that all the packets will reach the two firewall causing delays? packet loss? They don't seem to have major problems, but I feel like this is not best practise and it should be changed. Unfortunately they don't won't to leave just a firewall and use VLANs as I suggested but, would it not be better to setup the WAN interfaces on each firewall with a subnet containing only the IP addresses used on that firewall? (hope it makes sense...)

Or, do you have any other recommendation?

Many thanks.

Improve this question
5
  • Are the firewalls in a HA construct?
    – Winnie Tigger
    Jun 21, 2018 at 10:18
  • 1
    It sounds like a normal kind of structure with two fw on the public network, perhaps for failover. You could help us give you a better answer with some model numbers and some description of how the internal hosts are configured (do half use each fw? are the all configured to use one and fail over to the other? )
    – jonathanjo
    Jun 21, 2018 at 10:19
  • No failover. One fw used for VoIP the second fw for normal Internet traffic and obviously both live at the same time
    – 0r4cl3
    Jun 21, 2018 at 10:33
  • 1
    You haven't provided a lot of details, but it doesn't sound like there's a problem. I would not expect "delays or packet loss." There are lots of ways to design a network -- some are better than others, but most are adequate.
    – Ron Trunk
    Jun 21, 2018 at 11:53
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 25, 2018 at 8:54

1 Answer 1

Reset to default
4

This is OK. The ISP has issued a /28 subnet and two of those IPs are going to routers. Normally two routers on that subnet would be used for failover, but they could also simply be used as egress points for two or more separate networks. Assuming it's just the ISP's provider edge device and those two routers, the only traffic both routers will see that might not be explicitly destined for them is conventional multicast / broadcast traffic on that segment.

Improve this answer
2
  • Thanks Michael. Just out of curiosity, if both fw are setup with the same Public IPs, /28 subnet and GW, when an incoming packet reach the ISP device, which is directed to a specific IP address, how does it know which fw should be directed to?
    – 0r4cl3
    Jun 21, 2018 at 12:55
  • No problem. To your question, the ISP's routing would get the traffic to their demarc switch which dumps out into a layer 2 segment shared by their gateway and your firewalls / routers. From there, the traffic gets to the correct device using arp to find the MAC address of the device using that IP.
    – Michael D
    Jun 21, 2018 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.