Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here's my setup. I have Sonicwall NSA 2400, it is configured with Percentage-Based WAN Load Balancing.

  • LAN Interface: X0
  • PRI Interface: X1
  • T1 Interface: X2

My question is, given any LAN->WAN traffic originating from the X0 network, what steps would I need to take in the configuration to route all traffice from LAN->WAN for a given destination (example []) through a specific interface, in this case... X1

I'm having to do this because I'm setting up a site-to-site VPN connection and the remote end will only allow one WAN IP address to accept the tunnel, so I am trying to force all traffic for that destination over a specific interface.

Any help would be greatly appreciated!


share|improve this question

What I ended up doing was this:

Created a new Address Object under the Network > Address Objects menu. Click Add under "Address Objects", Put the name of the object, such as "Datacenter".

Zone assignment: WAN Type: Network Network: Netmask:

Click Add.

Next, Under Network > Routing

Click Add.

For Source, put in the LAN interface subnet, in my case I put in X0 For Destination, Select the Object we just created, "Datacenter" Service, Any (you can do FTP, HTTP, Etc only, if you want) Gateway: Default Gateway Interface: X1 (WAN Interface you wish the traffic to pass through) Comment: Datacenter over PRI

Click "Disable Route when the interface is disconnected" to allow for the WAN failover to still function, and traffic to reach the host if the interface is down.

Click Ok, and you're done!

share|improve this answer
For some reason, traffic is not passing over the tunnel, even though it is up and negotiated. Does anyone see a step I have missed to make all traffic pass over the tunnel ? I created a VPN Policy: DataCentertunnel ( xx.xx.xx.224 - xx.xx.xx.231 ESP: AES-256/HMAC SHA1 (IKE) Tunnel is up and active. If I tracert from the destination network (from WAN -> LAN) it only takes one Hop to reach destination, whereas if I tracert out from LAN->WAN it goes out over the public internet, versus the secure tunnel. – William Golden Nov 20 '09 at 21:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.