Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are in the process of replacing our firewall, which is currently the only thing connected to our Comcast Business Class modem. Comcast gives us 5 static IP addresses. Currently, all traffic to all 5 static IPs goes directly to the existing firewall.

Eventually, obviously all traffic will goto the new firewall, once the old firewall is removed from the network. But in the meantime, as we will have two firewalls plugged into the same Comcast modem, I need to route certain traffic to the new firewall instead of the old one. The firewall switchover is going to be slow and gradual as I am testing it, so I can't simply unplug the existing firewall and plug in the new one.

So my question is, how do I tell the modem to route all traffic that goes to a specific IP to goto the new firewall instead of the old one?

I've logged into the web interface for the modem, but the available options aren't very clear. There is a 1-to-1 NAT option (which I can't seem to get the interface for it to work properly) but I also see a "Static Routing" section. I always understood Static Routing to refer to routing data within the LAN though, so I'm not sure if that's what I'm looking for or not.

Keep in mind, I'm not looking to do simple port forwarding. I'm wanting 100% of traffic to certain public static IPs to go to the specified connected firewall (I'll deal with service policies there).

The modem is an SMC SMCD3G-CCR and is labeled as a Comcast Business Class Business IP Gateway. Any help or direction would be greatly appreciated.

UPDATE

Our solution was to just build and configure the new firewall, plug it into the modem and then log into the modem's web interface and use it's built-in NAT (which has a fairly clunky interface) to direct traffic accordingly during the testing phase.

Ultimately the new firewall was a success and we continued to use the modem's NAT features to route all the traffic to the new firewall and proceeded to decommission the old firewall.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

It sounds like you are over-complicating things. You should be able to just configure the new firewall with the IPs you want to go to it, then remove those IPs from the old firewall. Which IPs go where should be handled automatically by the ethernet layer.

Good luck,

--jed

share|improve this answer
add comment

We are having the same issue with Comcast biz modems. SMCD3G-CCR seems to have an issue of not allowing static IPs to passthrough. It seems the SMC is doing packet inspection and that is causing the issue.

Doesn't work SMC - gateway StaticIP1 - firewall

Does work SMC - gateway SMC DHCP - 10.1.10.100

Does work SMC - gateway SMC DHCP - 10.1.10.100 StaticIP1 - firewall

This tells me that bridging isn't enable until the SMC device issues a DHCP address to at least 1 machine. Sooo its not working properly.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.