We uplink a MX to a third party router/security appliance transparently.
The MX Internet port is connected to a LAN port on the “other appliance”.
The port on the other appliance to which the MX is connected is configured with an untagged LAN (n.b. not VLAN) in this case 192.168.22.0/28. But whatever, although probably better to avoid a public address.
A DHCP server is configured on the other appliance and it supplies an IP address to the MX.
The internet port on the MX (port 1) is configured:
- Enabled
- Trunk
- Drop untagged traffic
- Allowed VLANs - xxx, yyy, zzz, aaa, bbb
If you look at the Appliance Status page, you should see that the WAN IP address is that of the site's (dynamic) public IP address issued by the ISP.
The MX is not fazed by Double-NATting, so you probably won't need to worry about that, but it may be different with some VoIP phone models.
Looking at Security & SD-WAN > Monitor > Appliance Status > Uplink you should see how the WAN is configured:
Configured as: Dynamic
Status: Active
IP (DHCP): 192.168.22.14
Gateway: 192.168.22.1
DNS: 192.168.22.1