Set an indipendent second WAN interface

Question

Good morning, 
 I have two clusters of XGS 2100 in HA (Active-Passive) running with the firmware version 19.5.3 MR-3-Build652 . This is my current setup in both of the clusters: 
 
 WAN1 (ISP) > Port2 
 LAN > PortF1 
 HA > PortF2 - PortF2 
 
 As per object, in one of them, I need to set an indipendent second WAN interface (WAN2) for connecting a MPLS router that will be reachable only from a VLAN. This operation is quite simple and I made it from Network > Add Interface . I set the IP information, the WAN zone and the port. 
 
 The desired setup would be: 
 WAN2 (MPLS with NO Internet access) > Port4 
 VLAN > Port6 
 
 However, after I enable the port and I plug the cable in, that will connect the MPLS router to the Port4 of the firewall, the Load Balancing (that I don't need) starts to work and most ot my users lose the Internet access (WAN1). Even configuring the weights, for each gateway, from the WAN link manager , is not helping at all. 
 
 Furthermore, I tried to set my firewalling rules so part of the traffic gets forwarded to the WAN1 (I selected WAN from the Destination zones and Port2 from the Destination networks ) and some to the WAN2 (I selected WAN from the Destination zones and Port4 from the Destination networks ) but it is not working at all. 
 
 Do you have any suggestions or any idea on why this setup is not working? Please let me know if you need further information, I have been vague just to explain the main issue. 
 
 As a temporary workaround, I just created a VLAN on the switch, and on the XGS cluster, and connected the MPLS router directly to the tagged switch port. Of course, this is not sustainable and this is not the setup I want. 
 
 Thank you and have a nice day! 
 
 Best regards.

kerobra · Accepted Answer

You only have to create static routes for networks that your own firewall doesn't know how to reach. A default gateway on a WAN interface means a static route for 0.0.0.0/0 (any) to the IP address of your ISP's router/network. Which will mean your firewall will send traffic to other networks than locally known (assigned to a local interface) to that gateway. Your ISP kwows nothing about a 10.x.x.x network, since it is a non-routable, private network address. In cases where you have a network somehow connected over another way/router - lets say a network 10.0.0.0/24 is located behind that MPLS router (from your firewall's perspective) - then you will have to create a static route for 10.0.0.0/24 to the IP you know, in this case 10.10.200.1. 
 The other side (MPLS router) only knows your firewalls IP in the network both devices share (10.10.200.0/24). The clean way is routing all traffic to your local networks to your firewalls IP in that network. If your supplier refuses to add routes another way could be, that you use NAT for the traffic that passes to the MPLS router, SNATing (masquerading) it to your firewalls IP in that network (10.10.200.2/24). But in this case I would try to find another supplier. 
 
 A problem I see is your VLAN. You can't use the same IP range for your physical and your virtual interface. 
 
 If the traffic reaches the firewall untagged (without a VLAN ID) just use Port6. If the traffic reaches your firewall with a VLAN TAG of 210 then only use Port6.210 and give Port6 a dummy IP address like 10.11.12.13/30.

kerobra · Answer

If you want your secondary site to reach networks behind the MPLs it's nearly the same but it depends a bit on what technique is used (policy based VPN or route-based VPN with traffic-selector or any-any tunnel) and what device is on the secondary site. Do you have more information on that? Regarding your VLANs. Do you have to use VLAN tags on your end-devices to reach each-other or do you only have to connect them to the correct switchport to do so? If you do not have to edit the VLAN tag on the end devices your switch is using port-based VLANs, meaning your VLAN tag of 210 is directly assigned to the specific ports. Traffic that enters the switch has to be "untagged", without a VLAN tag and traffic that leaves the switch through a port is "untagged" again. In this case you do not have to use a VLAN-Interface on the firewall. Simpy connect a cable to a configured vlan-port of the switch, give the firewall the IP 10.10.210.1 on that port (6 in your overview), delete the vlan interface on the firewall and you are fine. A VLAN interface on the firewall is needed if you have 1 cable to a switch but you want to serve more than 1 network over that cable. In this case the physical adapter gets one network, and each VLAN adapter gets another network. On the switch that has to be devided by VLAN-tagging.There are different namings with VLAN, I don't know how Ubiquity is doing it. Some vendors call interfaces with more than 1 vlan "trunk interfaces", others use wordings like "untagged" and "tagged", others use wordings like "access", "trunk native", "trunk allowed".

PhilippRusch · Answer

Just remove the &bdquo;Gateway&ldquo; setting from this uplink.

PhilippRusch · Answer

Hello Leonardo, 
 as per your explanation I think you do not want a second "WAN" interface, because you said this is NOT used as an access to the internet. 
 I assume you assigned that interface to the "WAN" zone, which implies you have to assign a gateway and this interface will be added as a second uplink in "WAN-manager". 
 So just don't assign it to the "WAN" zone, if you do not intend to use it as a WAN-interface! 
 You could define a new zone, let's call it "MPLS" and this doesn't become part of the WAN-uplink manager group. 
 To reach other networks over this "MPLS"-interface you would need to define static routes, though.

PhilippRusch · Answer

Hello Leonardo, 
 that does not define a route through a gateway, as you might have thought. This is only a definition for a monitoring condition for uplinks. 
 What you want is a couple of static routes through that MPLS Gateway at 10.10.200.1 poiting to the other (remote) networks behind it. 
 You will need to specify the other networks in one route for each network.

PhilippRusch · Answer

Hello Leonardo, 
 you need to define the network you want to route to, not the host.

Set an indipendent second WAN interface

Top Replies