How to configure this IP Address to my firewall
I have a SonicWall firewall and we are getting a new internet line next week. I have an IP block range of the following below for what I am assuming is the provider router. (I edited for security reasons...) I all I need to worry about is the LAN block on this router, correct? Also, I am not sure how to interpret the /29 portion of the address. Its been a long time since I worked with this type of IP address scheme so do I just ignore that part of the address and just enter teh LAN IP, Mask and Gateway into the SonicWall WAN port and disregard the /29?
LAN IP BLOCK xx.xx.xx.xx/29
Subnet Mask 255.255.255.248
Gateway xx.xx.xx.xx
WAN IP BLOCK xx.xx.xx.xx/30
Provider PE 255.255.255.248
CE xx.xx.xx.xx
Subnet Mask
LAN IP BLOCK xx.xx.xx.xx/29
Subnet Mask 255.255.255.248
Gateway xx.xx.xx.xx
WAN IP BLOCK xx.xx.xx.xx/30
Provider PE 255.255.255.248
CE xx.xx.xx.xx
Subnet Mask
masnrock
Personally, I would get a layer 3 device (either switch or router). From what you've described, you're going to have to do your own routing, so the layer 3 device is necessary. On the interface connected to the ISP's equipment, you'd use your IP from the WAN block. On the interface connected to the Sonicwall's WAN port, you'd configure it for the LAN block. Then in the Sonicwall, you'd configure one of the IP addresses from the LAN block into the WAN interface. Last few times I did this, I used layer 3 switches (Cisco SG300-10 to be more precise), but it's not the only device you can accomplish this with.
ASKER
My configuration will be from the provider's equipment to my SonicWALL to our LAN switch. Why would I need a different router? Can't I simply just use this setup?
The ISP is doing a handoff that requires you do routing. What device you choose to do that with is up to you, but bear in mind it's not as simple as a "traditional" block of IPs that you just configure one and call it a day.
I chose to get the layer 3 equipment for two reasons:
1) To keep the rules on the Sonicwall simpler for others to work on (I was working for an MSP at the time)
2) I had to deal with other devices that needed public IPs but wouldn't be behind the Sonicwall
While it complicates the set up on a Sonicwall, it can definitely be done. You just have to be sure to define a number of routes. Plus I wasn't sure if you were intending to use other IP addresses for other devices that would be outside of the Sonicwall.
Here's an EE article that discusses what you're aiming to do:
https://www.experts-exchan
I chose to get the layer 3 equipment for two reasons:
1) To keep the rules on the Sonicwall simpler for others to work on (I was working for an MSP at the time)
2) I had to deal with other devices that needed public IPs but wouldn't be behind the Sonicwall
While it complicates the set up on a Sonicwall, it can definitely be done. You just have to be sure to define a number of routes. Plus I wasn't sure if you were intending to use other IP addresses for other devices that would be outside of the Sonicwall.
Here's an EE article that discusses what you're aiming to do:
https://www.experts-exchan
Hi,
The /29 is just another way of describing the subnet mask: 255.255.255.248. So the subnet mask on your WAN block would be /30, or 255.255.255.252.
As to whether you can ignore certain elements or not really depends on how the rest of your network is configured. Would you be able to provide a drawing of your topology. There is little or no security risk in detailing IP setup on your LAN. The only risk is to the WAN IP settings which you've hidden.
Questions that occur to me are:
What's hardware does your SonicWall connect into on your LAN side? I assume that it's a layer 3 switch.
Do you know what kind of Internet circuit you're having installed and how it's being presented?
Going on your description I would not agree that you'll need to add extra hardware to this setup to get it to function.
The /29 is just another way of describing the subnet mask: 255.255.255.248. So the subnet mask on your WAN block would be /30, or 255.255.255.252.
As to whether you can ignore certain elements or not really depends on how the rest of your network is configured. Would you be able to provide a drawing of your topology. There is little or no security risk in detailing IP setup on your LAN. The only risk is to the WAN IP settings which you've hidden.
Questions that occur to me are:
What's hardware does your SonicWall connect into on your LAN side? I assume that it's a layer 3 switch.
Do you know what kind of Internet circuit you're having installed and how it's being presented?
Going on your description I would not agree that you'll need to add extra hardware to this setup to get it to function.
What ISP do you have? (I know for example Comcast does this with their fiber service, whereas Cox does this once more than a certain number of IP addresses are requested)
ASKER
I will be bringing in EoC with XO Communications. They are planning to install their router into our suite now that the line has been completely installed. My impression is that there will be an Ethernet connection going from my SonicWALL WAN port to the LAN port of their router. Also, I would have a connection going from my SonicWALL LAN port to the Netgear 24 port Smart Switch. Then all devices of course would be plugged into the switch. Sorry for not putting together a diagram as I don't have time at the moment. Please confirm as I still don't believe I need to worry about routing.
More detailed information is really required, but at this point I see no reason for additional equipment. SonicWall's are quite pliable and can be configured to work in most environments.
Don't worry about the lack of diagram. The layer 3 device I was proposing would've gone between the ISP equipment and the Sonicwall. Talk to XO, and confirm that you'll have to do your own routing (this is what I figured the moment you provided the two blocks of IPs - the /29 block is your public IP block, the /30 is for interfacing with XO's equipment).
The SonicWall would be capable of the layer 3 / routing requirements.
ASKER
I asked XO if I will have to supply my own routing, and they said "We will be giving you a router that you will plug into"
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Ok, thanks. This is not implemented yet and I want to assume that I am on the right track. This sounds quite simple to setup as most things are already in place other than plugging up the new Ethernet cord to the SonicWALL and enter new IP information. Then voila.
well, other than adding the IP to the interface, are you going to have two ISP feeds or just one?
If just one, you would presumably be transitioning from the old to the new, so you may have to clone your old policies and apply them with the new IP/s. then when you transition by updating the public DNS record, you would disable the policies from the oLD isp connection...
If you have no policies that grant external access to internal resources, then it should be straight forward...
If just one, you would presumably be transitioning from the old to the new, so you may have to clone your old policies and apply them with the new IP/s. then when you transition by updating the public DNS record, you would disable the policies from the oLD isp connection...
If you have no policies that grant external access to internal resources, then it should be straight forward...