Secondary WAN IP from separate block on Sonicwall NSA 2400

I just got a new IP address from our ISP to assign to the WAN side of our Sonicwall NSA 2400 (SonicOS Enhanced 5.0.2.0-17o). I wanted to just assign it to the same X1 WAN interface as the existing IP, but couldn't figure out how to do that (multihome?). I then tried to add it to the X2 interface as a secondary WAN interface, but am getting an 'Invalid IP' error when I try to save the interface record. What's strange is that if I change the subnet mask from a /30 (255.255.255.252) to something at or below 255.255.255.250 I no longer get the error. Of course if I do that I can't communicate with the default gateway.

My existing IP is 64.x..x.x/255.255.255.252. My new IP is 174.x.x.x/255.255.255.252. All I really want to do is allow inbound HTTP/HTTPS to a new server that is in addition to the one we already have receiving that type of traffic on the existing IP. In the past I've done this on Sonicwalls using the 1-to-1 NAT configuration, but a.) that screen doesn't show up on the Sonicwall NSA 2400, and (more importantly) b.) when I've done this in the past it was with WAN IPs that were all in the same block, so there were no additional default gateways, etc.

Hope that makes sense to someone.
ajahnkeAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

B HCommented:
do you have the ability to upgrade that os to 5.6?

for your new static ip, is the new gateway also 172.x.x.x?
0
ajahnkeAuthor Commented:
I'm sure I probably could; is there reason to believe the current version is suspect?

Yes, the new gateway is also configured under the X2 secondary WAN interface, although I can only save the record if I assign an incorrect subnet mask to it.
0
B HCommented:
so, you need one subnet to talk to the gateway, but that subnet isn't supported on the interface... i was hoping 5.6 might have fixed that.

if you set it for 255.255.255.0, you should still be able to talk to your gateway, assuming your ip is a.b.c.d and your gateway is the same a.b.c.X

have you confirmed that the new ip/sn/gw config actually works thru your ISP connection?  are you able to set that up on a laptop and plug it into the ISP device and browse?
0
The Ultimate Tool Kit for Technolgy Solution Provi

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy for valuable how-to assets including sample agreements, checklists, flowcharts, and more!

castellansolutionsCommented:
I am note too clear here: is this waht you want

X0 - LAN (Internal IP Range)
X1-WAN - Current IP range (IP 64.x..x.x Mask 255.255.255.xxx, Gateway 64.xx.xx.001)
X2-WAN (Assign to zone if needed) 174.x.x.x, 255.255.255.0, 174.x.x.1

That will createwhat i think yopu want, also you then go and add a new network object and set the options to:

Type Host, Zone WAN.

If you've already tried that i didnt see it inyour post my apologies...
0
ajahnkeAuthor Commented:
That's pretty much exactly what I've done, and I'm not sure if I did it manually or if it was created as part of configuring the X2 interface, but there is an Address Object named 'X2 IP' with the new host IP and Type Host and Zone WAN.

Not sure if it matters, but just to be clear in case I wasn't - while the two addresses we've been given are from separate blocks, they are both /30/.252. I don't know if or why that would have anything to do with the 'Invalid IP' error I get when I try to configure it with that subnet mask, but using the .250 instead (which at least allows me to save the record) hasn't helped. In fact, I tried a ping test from the diagnostics page, and while it did say it was using its 174.x.x.148 IP/interface, it was unable to ping the default gateway (174.x.x.149).

Thanks for the replies -

0
castellansolutionsCommented:
Ok. Hmmm....

If you take the ips (As given to you by your provider) and put them into a laptop or desktop does the system take the IPs? (I am not asking if it works). I am just trying to see if the ips are valid.

I have gotten (2 seperate accounts, 2 seperate occasions) bad ips from XO - bad meaning the ips were numerically off and COULD not work no matter what.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
castellansolutionsCommented:
Also the other posters idea of connecting a laptop to the line itself (bypassing the sonicwall) was a good one and one i would try.
0
ajahnkeAuthor Commented:
Well, it looks like you were correct... I tried to use the IP/Mask/DG (.148/.252/.149) combo they gave me on my laptop and Windows threw an error saying there wasn't any room for hosts in the address. I guess I'm puzzled now trying to figure out what the right subnet mask is. I know I can ping the default gateway (.149) from the Internet, but can't ping it from the Sonicwall (.148) when I use a subnet mask that doesn't give me an error (i.e. .250 and .0)
0
castellansolutionsCommented:
Who is your provider? if its XO it wouldnt surpirse me also when ic alled to find out what was what XO gave me completely different ips! (So it wasnt like i could have fiddled with it and got it too work).

0
ajahnkeAuthor Commented:
It's TW Telecom, and what's worse is that I actually emailed the IP Manager as soon as I got the error earlier and she confirmed everything was right. I just emailed her back and will wait to hear back tomorrow.
0
B HCommented:
the subnet specifies what your neighbors are and who you're allowed to talk to.

they gave you bad info, but if you just change the subnet to 255.255.255.0 it should work fine, because that /24 will let you talk from 148 to 149 just fine.  

a subnet of 255.255.255.252 mathmatically means there's only two hosts on the subnet:  .149 and .150, with .151 being the broadcast address.  assume they want you to use .148 and use .149 as the gateway, that can't happen with a .252 subnet... but it can with 255.255.255.0... just to test with, but i think all your info is wrong from them.

i would try your wan ip of .150 and set the gateway to .151 and subnet .252 see what happens.
i would also try your .148 address using .149 as the gateway but with a /24 subnet

http://www.subnet-calculator.com/subnet.php

set that up with your ip info they gave you, and email them a screenshot.
0
ajahnkeAuthor Commented:
They're creating and sending me a new block that's /29, so I'll give that one a try and see how it goes. I did try .148/.149 with /24, but was still not able to ping .149 from .148.
0
ajahnkeAuthor Commented:
Well that seemed to have done the trick. Thanks for the input everyone!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Hardware Firewalls

From novice to tech pro — start learning today.