Watchguard FB Routing Question

Posted on 2012-03-13
Last Modified: 2012-07-18
Hi all,

I ran into this routing configuration and not understand how it is working, can some expert explain?

Network A:
Network B:



Two networks have their own DSL A & B on the WAN port. LAN side connecting to a shared switch. Theoritically speaking, the two networks cannot communicate with each other logically without a secondary IP configured on the FB and additional static route. For example, FB-A, I might need to add additional IP to the LAN port or Opt port, and FB-B, I might need to add additional IP to the LAN port or Opt port in order for both networks to see each other.

Question 1: In this case do I still need to create a static route? For example on FB-A, am I supposed to add

Question 2: Somehow without adding additional IP address on the LAN nor Opt port, example, FB-A has only one IP address, we have a static route By adding this static route entry and similar entry on FB-B (, we are able to communicate across each other.... Can some expert please explain what am I missing here? Why are they working???

Thanks in advance
Question by:BBQPM
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
LVL 14

Expert Comment

ID: 37719233
Question 1: No, you shouldn't need to configure static routes, as the router should add connected networks to its routing table automatically.  Also, you only need to add an additional IP to one of the routers (let's assume you add the IP to FB-A), then you can add only a static route on FB-B for to for the routing to work.

Question 2: I don't know the Firebox, but I do have an idea how this might work.  It hinges on the shared switch between the two routers - I assume that the two routers are connected to the same VLAN (the switch is either unmanaged, or the same VLAN is used on a managed switch). By adding a static route that point to the same local interface, you might force the router to use Proxy ARP, which allow the router to respons to ARP queries for addresses outside of its configured subnets.  But this is only a guess.

Author Comment

ID: 37723202
Hi Otto_N,

Appreciate your advice!

For question 2, actually that's my guess as well since I was able to pull the ARP table on the FB and showing all the mappings. Does it mean that any router must support Proxy Arp in order for it to work? I hope I can get a confirmation from someone because if not, we should be able to add a static route to other subnet and point the gateway back to itself without needing to add additional IP.

Moreover, when I tried adding similiar static route on my sonicwall for the same settings, my ping timed out so the same configuration not working on the sonicwall. Then I tried doing the same thing on linksys router, it simply error out saying invalid gateway.

Anyone can shed some light?
LVL 14

Accepted Solution

Otto_N earned 500 total points
ID: 37800603
@BBQPM, I do apologise for the long delay on my end.  Year-end can be quite taxing...

The feature is not really Proxy ARP, but a specific static route.  Let's see how the IP forwarding might work:  Let's say wants to talk to First, 0.5 will determine if the detination is in the same subnet, or a different one.  Since it is a different subnet, 0.5 will send this packet to theMAC address of the default gateway (  The router will then look into it's routing table to determine where are located.  But since this subnet is not directly connected (i.e. FB-A dos not have an IP address in the subnet), you either require a static route, or it will follow the default route out of the DSL link.

A static route can be configured in many ways.  The most generic is a command that tell the device to "route <dest-NW> to <next-hop-IP>", where <dest-NW> is usually the combination of the network address and subnet mask (such as or and <next-hop-IP> are the IP address of the nex hop, which is reachable with the routing table.  Some devices allow that the next-hop is specified using a particular exit interface, instead of an IP address (probably the case for the FB), however, I know that on other devices (like Cisco routers), this is only allowed if the exit interface is a point-to-point connection (i.e. it can't be Ethernet, for example).

So how do you tell a router that a particular subnet is reachable on an interface that is configured with a diferent subnet?  It seems that it differs between manufacturers.  For Firebox, it seems that a static route with next-hop the interface is sufficient.  For Cisco/Linksys, you will most likely have to configure secondary IP addresses on the interfaces.  I'm not sure how this is done for SonicWall, though.

I hope this helps you understand the routing process a bit better.  Let me know if I need to clarify some points.

Author Closing Comment

ID: 38200512
Looks like Watchguard Firebox allow static route to its own interface IP and there proxy Arp kicks in.

Featured Post

Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question