Watchguard FB Routing Question

Hi all,

I ran into this routing configuration and not understand how it is working, can some expert explain?

Network A:
Network B:



Two networks have their own DSL A & B on the WAN port. LAN side connecting to a shared switch. Theoritically speaking, the two networks cannot communicate with each other logically without a secondary IP configured on the FB and additional static route. For example, FB-A, I might need to add additional IP to the LAN port or Opt port, and FB-B, I might need to add additional IP to the LAN port or Opt port in order for both networks to see each other.

Question 1: In this case do I still need to create a static route? For example on FB-A, am I supposed to add

Question 2: Somehow without adding additional IP address on the LAN nor Opt port, example, FB-A has only one IP address, we have a static route By adding this static route entry and similar entry on FB-B (, we are able to communicate across each other.... Can some expert please explain what am I missing here? Why are they working???

Thanks in advance
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Question 1: No, you shouldn't need to configure static routes, as the router should add connected networks to its routing table automatically.  Also, you only need to add an additional IP to one of the routers (let's assume you add the IP to FB-A), then you can add only a static route on FB-B for to for the routing to work.

Question 2: I don't know the Firebox, but I do have an idea how this might work.  It hinges on the shared switch between the two routers - I assume that the two routers are connected to the same VLAN (the switch is either unmanaged, or the same VLAN is used on a managed switch). By adding a static route that point to the same local interface, you might force the router to use Proxy ARP, which allow the router to respons to ARP queries for addresses outside of its configured subnets.  But this is only a guess.
BBQPMAuthor Commented:
Hi Otto_N,

Appreciate your advice!

For question 2, actually that's my guess as well since I was able to pull the ARP table on the FB and showing all the mappings. Does it mean that any router must support Proxy Arp in order for it to work? I hope I can get a confirmation from someone because if not, we should be able to add a static route to other subnet and point the gateway back to itself without needing to add additional IP.

Moreover, when I tried adding similiar static route on my sonicwall for the same settings, my ping timed out so the same configuration not working on the sonicwall. Then I tried doing the same thing on linksys router, it simply error out saying invalid gateway.

Anyone can shed some light?
@BBQPM, I do apologise for the long delay on my end.  Year-end can be quite taxing...

The feature is not really Proxy ARP, but a specific static route.  Let's see how the IP forwarding might work:  Let's say wants to talk to First, 0.5 will determine if the detination is in the same subnet, or a different one.  Since it is a different subnet, 0.5 will send this packet to theMAC address of the default gateway (  The router will then look into it's routing table to determine where are located.  But since this subnet is not directly connected (i.e. FB-A dos not have an IP address in the subnet), you either require a static route, or it will follow the default route out of the DSL link.

A static route can be configured in many ways.  The most generic is a command that tell the device to "route <dest-NW> to <next-hop-IP>", where <dest-NW> is usually the combination of the network address and subnet mask (such as or and <next-hop-IP> are the IP address of the nex hop, which is reachable with the routing table.  Some devices allow that the next-hop is specified using a particular exit interface, instead of an IP address (probably the case for the FB), however, I know that on other devices (like Cisco routers), this is only allowed if the exit interface is a point-to-point connection (i.e. it can't be Ethernet, for example).

So how do you tell a router that a particular subnet is reachable on an interface that is configured with a diferent subnet?  It seems that it differs between manufacturers.  For Firebox, it seems that a static route with next-hop the interface is sufficient.  For Cisco/Linksys, you will most likely have to configure secondary IP addresses on the interfaces.  I'm not sure how this is done for SonicWall, though.

I hope this helps you understand the routing process a bit better.  Let me know if I need to clarify some points.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
BBQPMAuthor Commented:
Looks like Watchguard Firebox allow static route to its own interface IP and there proxy Arp kicks in.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.