topic Re: 3200 appliance instead of ISP router in Firewall and Security Management

3200 appliance instead of ISP router

NullBear — Fri, 05 Apr 2024 10:41:51 GMT

Hi everyone,

I've tried looking for solutions to my issue here on the community portal, but I haven't found a specific thread that addresses my problem. I've set up a lab environment at home, and I want to position the firewall in front of the router instead of behind it. Let me describe my current setup and explain what I'm aiming for.

Currently, internet comes in through an SPF fiber connection into a device called a media converter (CVT-3002_PLUS-DR). From there, an Ethernet cable connects to the WAN port of my router. In the router settings, I'm seeing two different IP addresses for the WAN. 10.66 is from the media converter and the 188 is public.

Desired setup: I want the internet to flow directly from the media converter into the CP3200 firewall, and then connect the router to the CP3200. Is this possible with the 3200SG? If yes, how do I achieve that?

Note: When connecting directly from media converter to any ETH1/2/3/4/5 ports, with or without populating IP / subnet details nothing happens. Can't ping anything from CLI.

Re: 3200 appliance instead of ISP router

the_rock — Fri, 05 Apr 2024 12:09:00 GMT

Here is what I would test, just my personal take on it...so if you configure all in your desired setup snippet and nothing happens, maybe try bridge mode to see if it makes a difference? If yes, then I would say probably something with the routing is failing. Maybe run zdebug to see why traffic is dropped.

Best,

Andy

Re: 3200 appliance instead of ISP router

Bob_Zimmerman — Fri, 05 Apr 2024 15:36:26 GMT

Whether this is possible depends largely on whether the router is doing anything more than simple Ethernet. For example, it may be doing PPPoE or various other protocols.

If it's regular IP over regular Ethernet, you should definitely be able to set it up how you describe.

Re: 3200 appliance instead of ISP router

the_rock — Fri, 05 Apr 2024 15:52:29 GMT

Thats definitely a valid point, but if it does not work, I would say we need to check what (if anything) might be getting dropped on the fw side.

Andy