Client Firewall behind the MXs

[JPScolar]

My client  wants to keep its Watchguard firewalls behind the MX appliances because he wants to control its network VPN remote access for its organization while benefiting of the SD-WAN advantages.  For this he will need a Public Static IP address  for the firewall but I think this is difficult to implement behind the MXs. In addition, at its DC facility,  we will have two MXs in High-Availability mode so changes on the IP address while on failover mode make break the Firewall VPN tunnels.  Any advise on the best possible architecture to cope with this situation?   Thank you for your help and comments.   

[alemabrahao]

You can create a link network between the MX and the Watchguard and in the MX create a nat for the Watchguard IP to the client VPN port.

[PhilipDAth]

Do you have a block of IP addresses (like a /28)?  Can you plug the Watchguard directly into the Internet connection, rather than behind the MX?

More than likely, he doesn't need an entire static IP address.  The Watchguard will need specific ports forwarded to it.  If you are using a VIP address on your MXs you could forward the ports from that to the Watchguard.
If you have a block like a /28, you could probably 1:1 NAT an entire IP.

[cmr · Accepted solution]

@JPScolar If the client only wants the SD-WAN features, then put the main site MXs in single ended concentrator mode behind the Watchguards.  We have our datacentre MXs set up this way (with another vendor's enterprise edge firewalls).  Less disruption and works very well.