Connect MX and virtual pfSense

[Lars_Petterson]

Hi there,

We are going to have two firewalls at the same location (same rack) and we need to connect these two together in order to route traffic from one firewall to another. Now here what I have been thinking which I need to verify with you guys. 

1. I need a link net (subnet) between two firewalls (an ethernet cable that goes from one firewall to another),

2. I need a route on both firewalls to route traffics,

3. I need policies to pass or allow certain traffic.

Are these three points sufficient to achieve this?

[KarstenI]

Yes, that is all you need.

For the MX, you should use a LAN-Port with your Link-Subnet and not one of the WAN-Ports for this. Also make sure that all internal systems route the traffic to these firewalls if not handled automatically with a default-route.

[Lars_Petterson]

Hi Karstenl,

Thanks for the answer. I dont understand the latter you wrote about internal systems, what do you mean by that?

[KarstenI]

Imagine an internal L3-switch which has a static route towards the MX, but a default-route to a different firewall. The traffic to the remote site would never reach the MX and there would be a static route needed to the MX.

[Lars_Petterson]

Do you mean that if I have a lets say default route 0.0.0.0/0 with wan IP as a default route and then I put the other route with a specific destination toward the other firewall, the traffic will still match the 0.0.0.0/0 and never reach the one we want! If thats the case, can we solve this with permanent routes on the clients itself?

route ADD destination_network MASK subnet_mask  gateway_ip