<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Consolas","serif";
mso-fareast-language:EN-US;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Hi Daniel,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Upfront I will say that personally I’m not a fan of Watchguard and have not used them for years....but technically normal firewall and IPv4 subnetting theory should apply, ie, it should be possible on any current business grade UTM/Firewall appliance by subnetting your public IP range and have some of your public range bound on eth0, and some of range bound to eth1 (DMZ presumably) with the servers, and your private IP on eth3 as a NAT’d interface. Bridge mode would not work as have more than 2 traffic bearing interfaces.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>For example just say you have a /24 public IP block of 101.101.101.0/24, you could split it into 2x /25 subnets which would be 101.101.101.0/25 and 101.101.101.128/25, if your upstream router was say 101.101.101.1, you could make eth0 101.101.101.2/25 with default GW of 101.101.101.1…The DMZ (eth1) interface could then be say 101.101.101.129/25 and your servers would have addresses from 101.101.101.130 to 101.101.101.254 with the GW as 101.101.101.129. Eth3 would be NAT’d with your private office network addresses (192.168.x.x?) as per a normal firewall.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Regards,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Mark Currie<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'> AusNOG [mailto:ausnog-bounces@lists.ausnog.net] <b>On Behalf Of </b>Daniel Watson<br><b>Sent:</b> Tuesday, 29 April 2014 3:28 PM<br><b>To:</b> ausnog@lists.ausnog.net; aussag@lists.aussag.net<br><b>Subject:</b> [AusNOG] WatchGuard X550E Configuration Assistance<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Gday Guys<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have recently acquired a Watchguard X550E Core Firewall Device which I would like to implement infront of our network in Sydney,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have never used Watchguard until today so I am looking for some guidance from people on-list whom might know if what I’m asking is correct<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Ideally I would configure Interface0 with a public IP which will be the uplink back to our router<o:p></o:p></p><p class=MsoNormal>Ideally I would then configure Interface1 with a public IP which will be downlink to switch were all servers are located<o:p></o:p></p><p class=MsoNormal>Interface2 would be disabled<o:p></o:p></p><p class=MsoNormal>Interface3 would be an uplink to switch on VLAN for PRIVATE NETWORK so we can eventually VPN into our private LAN<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If anybody whom uses Watchguard can tell me if this is correct way to go about this, it would be a huge help<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>TIA<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>Regards,<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>Daniel Watson<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>Network Administrator / Network Operations Manager<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>E <a href="mailto:Daniel@GloVine.com.au">Daniel@GloVine.com.au</a><o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>W <a href="http://www.GloVine.com.au">www.GloVine.com.au</a><o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><pre><o:p> </o:p></pre><pre>-- <o:p></o:p></pre><pre>This email was Virus checked by Sophos UTM 9. <a href="http://www.sophos.com">http://www.sophos.com</a><o:p></o:p></pre></div></body></html><pre>
--
This email was Virus checked by Sophos UTM 9. http://www.sophos.com</pre>