Using 7102dl as a firewall

[Thomas Raehalme]

Hi all!

I am planning changes to our office network and was wondering if the following scenario is possible to implement using ProCurve Secure Router 7102dl:

Our connection to the internet is a standard RJ-45 (the DSL is a separate box provided by our ISP). We have two networks (/26) of public IP addresses.

We want our servers to have public IP addresses that the server is aware of (i.e. no NAT). Some of the servers use an address in the first network and others use an address in the second network.

We'd like to use the router's firewall capabilities to protect our servers (as extra security as they also have internal firewalls). But we don't want to use NAT if possible.

For workstations we have specified a private network which should be able to access the internet using NAT. The router should take care of implementing the NAT. DHCP would also be useful.

Is it possible to connect eth0/1 and eth0/2 to the same network and make the router act only as a firewall?

Is it possible to add multiple networks to eth0/2, maybe using VLANs and have the router implement NAT for the private network and to only act as a firewall for the public network?

I have tried to find example scenarios that would match this situation but so far I haven't been able to find any.

Any help is appreciated!

Best regards,
Thomas

[Pieter 't Hart · Accepted solution]

The router needs to know wich adresses to route and direct to wich interface.

If you use the /26 subnet on the outside interface of the router, then you must NAT.
After all all adresses appear on the connecting interface.

If the connection is made with a total different subnet (/31 is sufficient), then it can route the complete /26 subnet to another interface (to a vlan in this case).

so it may be possible if you can agree with your ISP to use a third subnet only for the connection between your router and theirs.
then they can add routes for both /26 subnets with next-hop=your-router.

In the worst case you need to divide one /26 network into one /31 net and the rest but that config is less obvious.