Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a /29 subnet assigned by my ISP, with an SonicWALL office router and a Cisco voice router hooked up to a 'net-rail' of sorts with untagged VLAN switch ports connecting my ISP router's output and the two firewalls.

I'd like to use this as a routed subnet so that all connections hit my office firewall and I can DNAT to our internal network.

Is there anything that can be done without significant changes on our ISPs router?

share|improve this question
You can see if your switch is capable of Port Security feature? – Danila Ladner Apr 25 '13 at 20:54
It's hard for us to know without knowing anything about your current router setup. How is that subnet sent to you? Is it just bridged? Is it routed? – David Schwartz Apr 25 '13 at 21:01
@Danila - how would Port Security help in this situation? – Craig Watson Apr 25 '13 at 21:03
@David - I'll try and get some more info tomorrow (UK time) but I believe it's routed by our ISP to their router which is sitting in our rack. Their hand-off to us is a link into our net-rail. Sorry I can't be more specific! – Craig Watson Apr 25 '13 at 21:05
up vote 2 down vote accepted

Once it has the appropriate DNAT statements, your Sonicwall will automatically Proxy ARP for the other addresses on that connected network to your ISP. You do not need to "route" them to the outside IP address of your firewall.

share|improve this answer
Thanks, I'll do a bit of research on proxy ARP! – Craig Watson Apr 25 '13 at 21:42
It's automatic on Sonicwall, unless you specifically disable it, I believe. – SpacemanSpiff Apr 25 '13 at 23:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.