Multiple Internet Connections

[cjkenworthy]

Has anyone had any experience of using multiple internet connections (in our case 2 ADSL lines) with a Watchguard Firebox?

At the moment, we have a firebox III/700, and a single ADSL router hanging off the External port and want to add another ADSL connection.

Is it possible to maintain the firewalling, and do some clever NAT to control which internal PCs use which connection? Can the optional port be used as another external interface?

Thanks.

 

[hmills]

I am looking forward to some help with your question too. We have just added an additonal T-1 from a different vendor. The additional T-1 is to be only used to access our hosted database over the internet.

 

[cjkenworthy]

I got a response of our reseller and found out that it may be possible to 'reverse' the flow of traffic over the 'Optional' port on the firebox, using NAT and some clever rules. The reseller told me that this is not explicitly supported by Watchguard. I have however put down a few of my ideas below.

Another option (just an idea) is to plug a cable from the 'External' port to a switch, then have the two gateways (or multiple gateways) connected to the same switch. Configure some routes in the Firebox control panel (under 'Network > Routes...') you could specify the gateway for any outgoing traffic to a specified IP address, but this relates more to our specific problem. In effect this offers multiple gateways to the firebox

Perhaps take a look at at getting a load balancing router, which can handle packet filtering for your inbound connections. One I was looking at is a Neteyes C200

http://www.neteyes.eu.com.

There are others on the Internet.

If it is just incoming conections directly to one database server, then why not just connect the connection directly to the server with a software firewall (suicide but cheap), or buy a cheap SOHO firewall to protect the server.

Hope this gives you some ideas.

Chris

 

[hmills]

Thank You for your ideas. I think that I will try to connect the multiple gateways using a switch. Our T-1's are from different vendors therefore different networks. Are there any issues that you know of connecting the T-1's from different vendors and the external port to the same switch?

 

[cjkenworthy]

Providing each T-1 gateway has a different IP address, it should not matter.

I presume, like us, you have a router as a gateway at the connection with the T-1 circuit. We use an ADSL modem router as the gateway. It sits there exposing an IP address (public, but could be private), the firebox then delivers traffic to that IP address. So there is no reason why a switch cannot sit in between them, it would be just like a small LAN.