I have encountered an non standard issue and can't seem to figure out a way to get it to work.

I have 2 sites, 1 main and one branch.

At the main site I have 2 ISP's and the branch I have only 1 ISP.

My secondary ISP from the main site is the same one as the one I have at the branch site. My firewalls at both sites are sonicwalls but the issue would most probably happen on any firewall.

To summarize my setup:
Site1 = x1 ISP1, x2 ISP2
Branch = x1 ISP2

One more fact:
This ISP2 gives out the static ip's always with a /24 mask.

Now to the issue:
Any traffic from the branch office directed towards the main office gets drooped due to spoof detection, as the firewall of the main office expects the traffic originating from the branch office to come in on x2 interface (isp2) as the traffic is technically in the same subnet.

Is there any way to get this to work without involving another device to do NAT or disabling the spoof detection?

limiting the subnet mask won't work as the gateway IP of the WAN is .1.

  • Since Site1 and Branch are in the same subnet. Can you create a static route in the Branch to to route the to ISP1 IP to go through ISP2 IP as the gateway? I think you will need to create some access Rules to allow the connection from ISP2 to ISP1 in Site1 since they are both in the WAN. Jun 2, 2020 at 4:41

1 Answer 1


This is a classic split-horizon problem. I don't know how easy it will be to deal with on ethernet, or a sonicwall.

The last time I had this issue with a few cable modems, it took some inventive static routes and fudged netmasks to get around it. But this wasn't with security devices. In your case, disabling the built-in anti-spoofing and creating your own through ACLs may be the only way. (of course, you may have an issue of asymmetric routing as "branch" should also appear to be local/on-link.)

Can you get the ISP to use different blocks at each site?

  • I was trying to avoid that.
    – Yeahish
    Jan 16, 2020 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.