HP 5412rzl2 and Comcast Metro E Fiber connection

[Chuckak]

Installing Comcast Metro E 100mbit fiber connection.

Comcast states that I need a layer 3 device capable of routing the useable IP block (5 useable Internet public IP addresses) X.X.X.120/29  over their assigned point to point WAN IP X.X.X.0/30 - 1 IP and a gateway IP. This needs to be between my firewall and the Comcast provided Ciena device.  I temporarily connected an unmanaged switch between the firewalls and the Ciena device and I am able to make it work by using additinal IPs on the firewall interface but I am unable to configure IPSEC P2P tunnel on additonal IP addresses (firewall limitation) only on the actual interface IP (which is Comcast internal only)

The Ciena device provides a single port.  My firewalls need two ports to connect (HA active/passive).

Can I do this on a group of ports on the HP 5412rzl2 which is my core switch after the firewalls.

I will have 6 total ports that need routing to the single port.

If I can, how do I implement it?

[parnassus]

Hi, I'm not sure how the Aruba 5412R zl2 kicks into your WAN scenario (the Aruba 5412R zl2 is behind your Firewalls...so behind the NAT that is separating your LAN side from your WAN side)...for sure if your Firewall's HA (Heartbeat) link admits to pass through a switch - without mandatorily being a direct point-to-point connection between your two Firewalls - then the Aruba 5412R zl2 switch can help in that regard (as it happens with many other managed switches): just use two ports both untagged member of a dedicated VLAN without any associated IP Address (so no routing for that VLAN if routing is enabled on your Switch/Firewall)...doing so those two ports are definitely isolated from the rest of your internal network (a VLAN is a broadcast domain) and they can be used by your Firewalls as those two ports belong to another logically separated switch. Probably having the HA link passing through a Switch is not a good idea at all...AFAIK HA (Heartbeat) link(s) should always be direct copper/fiber optic link(s) between appliances forming a Cluster.

[Chuckak]

The firewalls HA communications are directly connected to each other (not through the switch).  IP Routing is in the switch config.  I created a dedicated VLAN and set all the ports to untagged for that VLAN.  1 port will connect to the  Comcast Ciena device.  How do I assign the single IP X.X.X.X /30 address and its gateway to that port?  The remaining 6 ports are plugged into the 3 external interfaces on each firewall.  These interfaces will have 3 of the 5 public IPs directly on their interfaces.  The remaing 2 available IPs will be an additional IP on one or more of the interfaces (this is all done on the firewall).

How do I route the 6 ports through the 1 port connected to the Ciena device?

[parnassus]

---

@Chuckak wrote: How do I assign the single IP X.X.X.X /30 address and its gateway to that port?

---

You can't. Aruba 5400R zl2 doesn't let you to set a particular port in "routing mode"...at best you can configure a VLAN, assign it a dedicated IP Addressing (that VLAN will start to partecipate to IP Routing) and then use that VLAN IP Address to route traffic through the last resort route or through a static route to preferred directly connected gateway interface...letting a port to be a untagged member of that VLAN (or letting a port to be tagged member of that VLAN, if Firewall side you're tagging the LAN port used for downlink to the Switch).