Support for more than 2 WAN subnets on the WAN side

[Pugmiester]

Hi all,

As we're deploying out MX's across our EU sites we have run up against a little issue with a site that has 4 different small subnets supplied from their ISP, one of the joys of the IPv4 exhaustion and a lot of locally hosted services.

While we will likely end up moving the services across to the first 2 subnets, there's a lot of third party involvement which will inevitably lead to service outages, as they do when you don't have visibiity of both sides of a connection.

Obviously we could assign a subnet to each WAN interface (We're running an MX-250) but is there any way we could make use of the additional subnets?

[PhilipDAth]

You could have them all routed via a single WAN interface if you want, and then just NAT the public IP addresses to the internal IP address of a server.

[Pugmiester]

Hi @PhilipDAth, the services are all NAT on the current firewall so we would be reproducing the same setup but it's just not very clear how you can create a 1:1 NAT for an IP address that's not in the WAN subnet. The MX has no idea what the gateway would be for that second subnet without some way to configure it on an interface somewhere.

[PhilipDAth]

You are over thinking this.  🙂

You just create the 1:1 NAT.  You can create a 1:1 NAT for 8.8.8.8 if you want - it just wont work because 8.8.8.8 is not being routed towards your MX.

The MX has a default gateway - which it will use for everything when there is not a more specific route.

[hockeydude]

Gateway for MX is IP of upstream router. 1:1 NAT Philip is talking about is for servers/workstations on LAN communicating to internet using upstream router's subnets. So... Pretend MX 10.0.0.2 talks to upstream router 10.0.0.1. Server on LAN has IP 192.168.0.100 which NATs to 10.0.0.100. From there setup rule on upstream router to NAT 10.0.0.100 to whatever subnet is available on WAN. Depending on your public IP block, you can give outbound an explicit IP which would be different from default gateway.