In my current setup, my ISP is directly connected to my firewall. Now I want to add a PC that I can put Static IP to test the ISP directly outside of the Firewall. would this be possible? I have 5 IP from my ISP provider that I can use.

enter image description here

  • 1
    Please tell us about the firewall-to-ISP interface, then we can give you better answers.
    – jonathanjo
    Aug 6 '18 at 17:07
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25 '18 at 9:13

You said that you have 5 usable IPs so it sounds like you have a /29 subnet coming from the ISP where the next-hop IP is part of that /29. If you have an Ethernet handoff then you can certainly use a switch to breakout raw internet.

I would suggest that you use a separate switch rather than using your core switch to do the breakout. Also do not configure an SVI on the switch with an IP address in the raw internet subnet, this is a major attack vector as a hacker can now access the switch directly from the raw internet. If you need to manage the switch locally then create separate VLANs one for RAW internet and another for management.

  • Ensuring no one can control the switch from outside the network is an extremely good point; using a separate switch too.
    – jonathanjo
    Aug 8 '18 at 12:25

On the assumption that the ISP presents as ethernet, certainly.

As a recommendation, don't leave your PC unprotected on the internet for very long; alternatively, put in another firewall, parallel to the existing one.

EDIT: as reminded by Marc Luethi in comments: I was thinking of the ordinary case of the ISP presenting ethernet, with static addressing of hosts (from questioner's statement of 5 addresses allocated). Other mechanisms are also very common, including DHCP (depends what ISP does), or PPPoE and others, which are less straightforward and again depend greatly on the ISP.

  • would a regular switch work? Aug 6 '18 at 11:02
  • @jonathanjo: That entirely depends on how IP address assignment is done by the ISP. If DHCP (and the Firewall is a DHCP client), it will only work if the ISP allows for a second DHCP client on the same segment. If PPPoE, and the Firewall is PPPoE client, then the same applies - the ISP must allow for a second PPPoE client. However, if there is a CPE device in front of the existing Firewall and the IP subnet between CPE and Firewall is done with public IP addresses, then things can work by adding a switch, plugging in a second FW (not a PC!), giving it an IP from the ISP subnet and.. go! Aug 6 '18 at 11:09

It all depends on how your ISP presents those 5 IPs.

There are multiple ways an ISP can present IPs to you over an Ethernet or Ethernet-like interface.

They can route the IPs to the interface without specifying a next hop, in which case their router will arp (or ND for IPv6) for each IP individually and you can use a switch to spli.

Alternatively they can route all the IPs to a single gateway IP (normally from a seperate subnet to your main block), in this case you would need a layer 3 device to split them up as traffic for all of them would be sent to the MAC address associated with the gateway IP.

They could also use PPPoE, in this case it's most likely that all the IPs would be routed to a single PPPoE client, though they may be able to support multiple seperate PPPoE sessions if you ask them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.