topic Re: defining a gateway with internal or external IP in Firewall and Security Management

defining a gateway with internal or external IP

Daniel_Kavan — Mon, 27 Sep 2021 18:24:17 GMT

I was taught to always define the gateway with the external IP because then you know the routing is work to the gateway. However, since then other engineers define the gateway with the internal IP. Does it really matter? Ask a different engineer, get a different answer?

I should create a poll question for this one.

Re: defining a gateway with internal or external IP

PhoneBoy — Mon, 27 Sep 2021 18:35:50 GMT

The main IP (configured in the relevant object on the general tab) is used for communication between the gateway and management.
As long as those IPs are reachable to each other bidirectionally, you should be fine.

Another feature that uses the main IP by default is VPN (both Site-to-Site and Remote Access).
If you need to use something other than the external IP there, then you probably will need to adjust the Link Selection setting to use a different IP.

Re: defining a gateway with internal or external IP

the_rock — Mon, 27 Sep 2021 19:58:53 GMT

Phoneboy gave you a perfect answer. The main thing to remember is that even with VPN, you can definitely tweak link selection, if you use multiple external IP links. So even if you have say internal IP as main IP address, thats totally fine, lots of customers do that...as long as mgmt can access it back and forth and policy works, no issues. Just make sure link selection tab reflects actual external IP intended for VPN use, thats all.