Watchguard FB Routing Question

Posted on 2012-03-13
Last Modified: 2012-07-18
Hi all,

I ran into this routing configuration and not understand how it is working, can some expert explain?

Network A:
Network B:



Two networks have their own DSL A & B on the WAN port. LAN side connecting to a shared switch. Theoritically speaking, the two networks cannot communicate with each other logically without a secondary IP configured on the FB and additional static route. For example, FB-A, I might need to add additional IP to the LAN port or Opt port, and FB-B, I might need to add additional IP to the LAN port or Opt port in order for both networks to see each other.

Question 1: In this case do I still need to create a static route? For example on FB-A, am I supposed to add

Question 2: Somehow without adding additional IP address on the LAN nor Opt port, example, FB-A has only one IP address, we have a static route By adding this static route entry and similar entry on FB-B (, we are able to communicate across each other.... Can some expert please explain what am I missing here? Why are they working???

Thanks in advance
Question by:BBQPM
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
LVL 14

Expert Comment

ID: 37719233
Question 1: No, you shouldn't need to configure static routes, as the router should add connected networks to its routing table automatically.  Also, you only need to add an additional IP to one of the routers (let's assume you add the IP to FB-A), then you can add only a static route on FB-B for to for the routing to work.

Question 2: I don't know the Firebox, but I do have an idea how this might work.  It hinges on the shared switch between the two routers - I assume that the two routers are connected to the same VLAN (the switch is either unmanaged, or the same VLAN is used on a managed switch). By adding a static route that point to the same local interface, you might force the router to use Proxy ARP, which allow the router to respons to ARP queries for addresses outside of its configured subnets.  But this is only a guess.

Author Comment

ID: 37723202
Hi Otto_N,

Appreciate your advice!

For question 2, actually that's my guess as well since I was able to pull the ARP table on the FB and showing all the mappings. Does it mean that any router must support Proxy Arp in order for it to work? I hope I can get a confirmation from someone because if not, we should be able to add a static route to other subnet and point the gateway back to itself without needing to add additional IP.

Moreover, when I tried adding similiar static route on my sonicwall for the same settings, my ping timed out so the same configuration not working on the sonicwall. Then I tried doing the same thing on linksys router, it simply error out saying invalid gateway.

Anyone can shed some light?
LVL 14

Accepted Solution

Otto_N earned 500 total points
ID: 37800603
@BBQPM, I do apologise for the long delay on my end.  Year-end can be quite taxing...

The feature is not really Proxy ARP, but a specific static route.  Let's see how the IP forwarding might work:  Let's say wants to talk to First, 0.5 will determine if the detination is in the same subnet, or a different one.  Since it is a different subnet, 0.5 will send this packet to theMAC address of the default gateway (  The router will then look into it's routing table to determine where are located.  But since this subnet is not directly connected (i.e. FB-A dos not have an IP address in the subnet), you either require a static route, or it will follow the default route out of the DSL link.

A static route can be configured in many ways.  The most generic is a command that tell the device to "route <dest-NW> to <next-hop-IP>", where <dest-NW> is usually the combination of the network address and subnet mask (such as or and <next-hop-IP> are the IP address of the nex hop, which is reachable with the routing table.  Some devices allow that the next-hop is specified using a particular exit interface, instead of an IP address (probably the case for the FB), however, I know that on other devices (like Cisco routers), this is only allowed if the exit interface is a point-to-point connection (i.e. it can't be Ethernet, for example).

So how do you tell a router that a particular subnet is reachable on an interface that is configured with a diferent subnet?  It seems that it differs between manufacturers.  For Firebox, it seems that a static route with next-hop the interface is sufficient.  For Cisco/Linksys, you will most likely have to configure secondary IP addresses on the interfaces.  I'm not sure how this is done for SonicWall, though.

I hope this helps you understand the routing process a bit better.  Let me know if I need to clarify some points.

Author Closing Comment

ID: 38200512
Looks like Watchguard Firebox allow static route to its own interface IP and there proxy Arp kicks in.

Featured Post

WordPress Tutorial 1: Installation & Setup

WordPress is a very popular option for running your web site and can be used to get your content online quickly for the world to see. This guide will walk you through installing the WordPress server software and the initial setup process.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
Make the most of your online learning experience.
Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question