Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a SonicWall TZ180 that acts as a VPN endpoint. Right now it has one WAN IP address and a /24 assigned to the LAN interface. Our mail cluster administrator asked if it was possible to add a second private class C behind the VPN. This second subnet would be available to the other network and then we would use address objects and acls to limit access.

Is this possible? I read up on PortShield but I don't know if that's what we would need to use because we're pushing all data out of one physical port into a Cisco switch that has VLANs already set up.

Addendum: It appears that PortShields will do what I want with only one limitation; it requires a direct 1-1 relationship of portshield to physical port. This would then limit us to 4 PortShields on 1 TZ180. Is there a better solution than this?

share|improve this question

Portshield interfaces group interfaces together, basically treating all ports in the group like a common switch port. So all ports in the LAN Portshield group would all share the same network. That doesn't sound like it will meet your needs.

It sounds like you want to add a different network so you can then create rules for traffic between the LAN and this new network. That should be as simple as creating a new zone (for example 'LAN2' or 'DEV') and assigning an unused port to that zone (turn off Portshield if necessary). Give it a new network and you can then create firewall rules based on the zones.

Does that make sense?

share|improve this answer

Not sure about Sonicwall, but on a Cisco ASA, you can just carve out a new VLAN on your internal switches and trunk that connection along with your regular internal subnet to the physical ASA port. Then you create a new virtual interface on the physical ASA interface for the new VLAN. You can then set whatever ACLs you need to directly on the ASA.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.