Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As shown by the network diagram below, I have two completely separate networks. One is being managed by a Sonicwall NSA 220, the other by some other router (the brand is not important). My goal is to allow devices within the network to access devices in the network. Allowing the reverse ( -> is not required.

So far, I have done the following: I connected the X3 Interface on the Sonicwall to the network switch (shown as the dashed red line in the diagram). Next, I gave it a static ip address of and set the Zone to LAN (the same Zone for the X0 interface). Judging by various articles and KBs I've read, this is all that should be necessary, although it does not work.

I can ping from any device in the network although I cannot ping/connect to any device within the network.

Any help would be greatly appreciated!

Network Diagram: Network Map

(I asked a similar, yet more complicated, question earlier; although, I realized that I cannot solve that without first solving this (which may actually solve my original question))

share|improve this question

Devices in need to know that they can reach devices in via The way they'll know that is to create a route on "Another Router" for via


When you ping or connect to a device in the return traffic has to have a path back to the device in that originated the traffic. That path needs to go through By default all non-local traffic in will be forwarded to "Another Router" since it's the default gateway for hosts in the network. Once you have the route configured in "Another Router" you need to create a firewall rule on the Sonicwall that blocks traffic originating in from accessing When traffic originates from the return traffic will be allowed through the firewall since it originated in

share|improve this answer
Even if the device in initiates the connection? Devices in will never need to access devices in – Rain Nov 26 '12 at 1:33
Yes. See my edit. – joeqwerty Nov 26 '12 at 1:44
Well shoot. I do not have easy access to the router on It is also very, very old. Next time I get a chance to explore the web interface I'll give your suggestion a shot. If it works, I'll come back and accept your answer! Thanks! – Rain Nov 26 '12 at 2:06
If you don't have access to the router but you do have access to the devices you can manually add a route to the routing table on each device. This isn't recommended because it's a lot of manual work, prone to error and would need to be updated if the route ever changes, but it will work. – joeqwerty Nov 26 '12 at 2:14
You could have the SonicWall do NAT. For all hosts in sending to, it could NAT the source IP to – David Schwartz Nov 26 '12 at 4:21
up vote 1 down vote accepted

As recommended by David Schwartz, the way I solved this problem was to create a NAT entry in the SonicWall that translated the "Source Address" from the network to the SonicWall's interface address on the network. Then I allowed traffic to go from all LAN subnets on the sonicwall to the X3 subnet. Works like a charm.

(I meant to post this answer a while ago; never got around to it).

share|improve this answer

it might be late for RAIN, but as I was among the people who still faced this issue, I thought it might help others also to learn another more direct approach on this setup:

Example for

Under Network Menu Click Address Objects.
Name: My Secondary Subnet (or any friendly name)
Zone Assignment: LAN
Type: Network
Netmask: (This is for a /24 change as needed)
Click OK

Under Network Menu Click ARP
Static Arp entries > ADD
IP Address: (use the IP you want to be your default gateway for this subnet)
Interface: X0 (Choose your current LAN port)
[x] Publish Entry
[ ] Bind Mac Address (Do not select)
Click OK

Under Network Menu Click Routing
Under Route Policies choose Add
Source: Any
Destination: My Secondary Subnet (Or whatever you named your new Address Object)
Service: Any
Interface: X0 (or the port you chose in ARP setup if your LAN port was not X0)
Metric: 20
Click OK

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.