I have encountered an non standard issue and can't seem to figure out a way to get it to work.

I have 2 sites, 1 main and one branch.

At the main site I have 2 ISP's and the branch I have only 1 ISP.

My secondary ISP from the main site is the same one as the one I have at the branch site. My firewalls at both sites are sonicwalls but the issue would most probably happen on any firewall.

To summarize my setup:
Site1 = x1 ISP1, x2 ISP2
Branch = x1 ISP2

One more fact:
This ISP2 gives out the static ip's always with a /24 mask.

Now to the issue:
Any traffic from the branch office directed towards the main office gets drooped due to spoof detection, as the firewall of the main office expects the traffic originating from the branch office to come in on x2 interface (isp2) as the traffic is technically in the same subnet.

Is there any way to get this to work without involving another device to do NAT or disabling the spoof detection?

limiting the subnet mask won't work as the gateway IP of the WAN is .1.


This is a classic split-horizon problem. I don't know how easy it will be to deal with on ethernet, or a sonicwall.

The last time I had this issue with a few cable modems, it took some inventive static routes and fudged netmasks to get around it. But this wasn't with security devices. In your case, disabling the built-in anti-spoofing and creating your own through ACLs may be the only way. (of course, you may have an issue of asymmetric routing as "branch" should also appear to be local/on-link.)

Can you get the ISP to use different blocks at each site?

  • I was trying to avoid that. – Yeahish Jan 16 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.