0

We have a situation that I'm not sure how to proceed correctly.

This location is currently utilizing two different firewalls - a Sophos XG 310 and a Sonicwall NSA 3500. The way this was originally configured, a small switch was put in place before the firewalls, with one ISP connection coming into the switch, then one connection from the switch going to each firewall. They have one public IP from their ISP going to the Sonicwall, and one public IP (for the same ISP connection) going to the Sophos.

I am wanting to move the public IP that is currently on the Sonicwall to the Sophos without disrupting the flow of traffic to the ISP. They have several services that use the public IP that is currently on the Sonicwall.

How can I move the connection from the Sonicwall to the Sophos as a second interface for the same ISP and allow communcation for the services to work properly?

enter image description here

Best description I can come up with is that ...120 has a NAT for connecting to Remote Desktop Gateway with ...120:45678. I want to move the ...120 interface from the Sonicwall on the left to the ...121 Sophos on the right. Do I create a second interface on the Sophos, then create the NAT and firewall rules? Seems off to me to have two different public IP's on two different interfaces from the same ISP pool. There are even more services on the old Sonicwall in addition to the one I described, but trying to keep this as simple as possible.

5
  • We need more information in order to help you. Please edit your question to include a simple network diagram, along with the configurations of relevant devices. – Ron Trunk Apr 28 at 14:43
  • Edited with information requested. – me55enger Apr 28 at 15:43
  • "I am wanting to move the public IP that is currently on the Sonicwall to the Sophos without disrupting the flow of traffic to the ISP." Any such switchover will disrupt traffic for a period of time. – Ron Maupin Apr 28 at 16:41
  • Sorry, poor wording. Was thinking more along the lines of the services being moved from Sonicwall to Sophos actually working when moved to the Sophos. I realize there will be a disruption when actually moving the connection over. – me55enger Apr 28 at 17:05
  • I don't know anything about Sophos devices, but @Rais is correct: if you were moving it the other way (to the SonicWALL) you can't have two interfaces on the same subnet, but you can utilize 2 IPs on the same subnet for NAT and Firewall rules - perhaps the Sophos is the same. So just make a new NAT/Firewall rule using the .120 IP. On a SonicWALL you just create Address Objects in the WAN Zone and use them like the ones for the WAN IP itself. (And if they are different subnets, eg. both /32, then you can use separate interfaces since the device won't see a conflict that way). – PSaul May 1 at 4:34
2

A firewall may not allow two interfaces using IP addresses from the same subnet. May be you can use a secondary address on the same interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.