Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Watchguard XTM 2 that is currently acting as a firewall and a router for my business network, I currently have the WG setup in mixed-routing mode and am happy with the current configuration. The reason I am curious about drop-in mode is because I would like to use all the interfaces on the back of the watchguard for the same subnet.

My understanding is that drop-in mode will put them all on the same subnet, but it is unclear from the manual that the routing/firewall/vpn will still work as expected.

This WG is right behind a DSL modem that is setup in bridge mode, so the WG is handling all PPPoE auth and routing for the network.

share|improve this question
I believe it used to be that if it is drop-in the everything is bridged and you can't do routing, but I haven't used a Watchguard for about 5 years. – Zoredache Aug 11 '10 at 7:21

We have a xtm21-w and according to the docs in drop-in mode all the interfaces are on the same network.

From the watchguard online docs

In drop-in mode:

  • You must assign the same primary IP address to all interfaces on your Firebox or XTM device (external, trusted, and optional).
  • You can assign secondary networks on any interface.
  • You can keep the same IP addresses and default gateways for hosts on your trusted and optional networks, and add a secondary network address to the primary external interface so your Firebox or XTM device can correctly send traffic to the hosts on these networks.
  • The public servers behind your Firebox or XTM device can continue to use public IP addresses. Network address translation (NAT) is not used to route traffic from outside your network to your public servers.

The properties of a drop-in configuration are:

  • You must assign and use a static IP address on the external interface.
  • You use one logical network for all interfaces.
  • You cannot configure more than one external interface when your Firebox or XTM device is configured in drop-in mode. Multi-WAN functionality is automatically disabled.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.