1

I am trying to wrap my head around setting up my new watchguard M400. Here's what I need to figure out and what I've done so far.

My ISP provided me with a P2P IP, which I plugged into my interface (107. address). They also have me a block of IPs on a different subnet (completely different range too, 50. range) so keep that in the back of your mind. I also have a private (192.) that I want to use.

I have interface0 setup with the P2P IP (external) and an internal setup (trusted) with a simple 192.

I have a few switches behind the firewall:

Switch one (name:CORE1) is a 48 port, which will have many VLANs on it. Port one if obviously going to be the firewall (trunk) port.

Port two will be an uplink to another switch (name:CORE2, VLAN=4) for my separate camera network.

Some other ports will be private to the office that the firebox is housed in (trusted network) VLAN=5

The rest of the ports on the 48 port (CORE1) will be plugged into servers that need public IPs assigned to them, and when communicating with the outside, they need to show their public IPs, not the IP of my firebox (which would normally show the P2P address)

I think I got this to work (sort of) but creating an optional interface, assigning the first IP of my block to it, then I set another one of the block to my laptop and it worked all magically.

The problem is with that approach I would need to have multiple connecting going from the firebox to the switch which I don't think would work.

I tried setting up VLAN on the box, but it wants me to create a seperate interface for that which I am not sure I want to do?

I have included a makeshift drawing I made to help you visualize:

makeshift drawing

Now, my interfaces on my firebox look as follows:

enter image description here

So you can see the three interfaces. I just made the "VLANUplink" just to test, so that is junk. I really would like to condense all that down as much as I can.

I tried playing with the VLAN properties, where it wanted me to setup a special interface for VLANs for some reason, thats why you see the "vlanuplink" interface. Again,this is all trash.

And for those of you who refer me to online articles, I have read over many articles all night and I am not allowed to post them since I don't have enough "reputation". But trust me on that.

I did find this awesome article here:

Since I can't post link, go to google type "use public Ip address behind xtm" it's the first PDF.

And I think I would be considered "scenario 1" but correct me if I am wrong. Please refer to my makeshift network map I drew to compare. I want everything behind the firewall, but nothing behind the firewall to communicate with each other, that is why the vlanning is there.

2
  • Anyone? I am surprised nobody knows how to do this. Apr 4, 2015 at 18:19
  • Are you wanting the watchguard to do your vlan routing? This is really a gateway device, and you usually make out better by having a layer 3 switch or core router handle this.
    – Joel Coel
    May 27, 2015 at 3:21

2 Answers 2

2

As this has just been bumped to the front page - you probably didn't need the "use public IP address behind XTM" scenarios, and did want to make new VLAN interfaces.

Set Interface 0 as External, allocate the public address as you did.

Make new VLAN interfaces, one for each VLAN. Set them as 'optional', give the firewall an internal IP address in each VLAN and maybe configure DHCP if needed. Each device in a VLAN should get the firewall's IP in that VLAN as its gateway - using the firewall to serve DHCP will do that automatically, if they're configured manually or something else does DHCP you'll have to set that.

Then set Interface 1 as a VLAN interface, and tag it to send traffic for all the VLANs you just defined.

To get distinct public IP addresses for some servers, add 1-1 NAT entries to map the public IPs to the server's internal IPs.

Make firewall policies for traffic between the VLANs, e.g. Allow "Any from VLAN2 to VLAN5", whatever's appropriate to create the separate camera network and private office network.

On the switch side set it as a VLAN trunk port.

This setup only takes one cable from firewall to switch (although it's easy to add more cables if you need extra bandwidth - configure Interface 2 as a VLAN trunk and tag some VLANs onto Interface 1 and some onto Interface 2).

1

You're asking a lot here, and on some fairly specific hardware, so I'll just give some high-level guidance to keep this reasonable.

First, the servers. You want them to have public IPs. That's fine and good. However, they are also part of your internal network; give them internal IPs. Then you need to setup port forward policies on the watchguard to map the public IP for each server and forward the traffic to the correct internal address. You probably want to pair this with setting up records in your local DNS server so that any domains you have publicly pointed to the internet IPs will be pointed to the local IPs if you do the lookup from inside your network.

Next, the switches. Your diagram depicts the CORE1 switch as much more important/central than the others. If it can, you should have this switch do your vlan routing, instead of the watchguard. That switch should have a virtual interface for each vlan, and whatever is doing dhcp on your network should hand out the appropriate interface IP on the switch as the default gateway to all devices. The switch itself should set the watchguard's internal IP as it's gateway, and have routes to all of the vlans. Then set the port going to the watchguard as a trunk port, or just tag all of the vlans except the one for the watchguard's internal IP (that one will be an untagged member).

Now on the watchguard you to set up NAT policies and routes for each of your internal networks, and of course the port forward policies for the servers. You should only need to configure two of your interfaces to accomplish this, and a single cable will be able to handle all of this traffic.

Unfortunately, I can't be more specific than that. I have successfully configured a Watchguard 400 series in this manner, but only as a demo that we later returned, and so I can't be more specific at this time on where to go for each option. (FWIW, we're using Untangle now instead, and I like much better).

1
  • 2
    I know this is old now, but something bumped it to the front page again, so I thought it was worth adding a few words.
    – Joel Coel
    May 27, 2015 at 3:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .