About Network Modes and Interfaces

A primary component of your Firebox setup is the configuration of network interface IP addresses. When you run the Web Setup Wizard or Quick Setup Wizard, you set up the external and trusted interfaces so traffic can flow from protected devices to an outside network. You can change the interface configuration to add other components of your network to the configuration. For example, you can set up an optional interface for public servers such as a web server.

Your Firebox physically separates the networks on your Local Area Network (LAN) from those on a Wide Area Network (WAN) like the Internet. Your device uses routing to send packets from networks it protects to networks outside your organization. To route packets through your device to the correct destinations, your device must know which networks are connected on each interface.

We recommend that you record basic information about your network and VPN configuration in the event that you need to contact technical support. This information can help your technician resolve your problem quickly. For guidelines about what information to have ready before you call WatchGuard for support, see Working with WatchGuard Customer Support.

Network Modes

Your Firebox supports several network modes:

Mixed routing mode

In mixed routing mode, you can configure your Firebox to send network traffic between a wide variety of physical and virtual network interfaces. This is the default network mode, and this mode offers the greatest amount of flexibility for different network configurations. However, you must configure each interface separately, and you may have to change network settings for each computer or client protected by your Firebox. The Firebox uses Network Address Translation (NAT) to send information between network interfaces.

For more information, see About Network Address Translation (NAT).

The requirements for mixed routing mode are:

All interfaces of the Firebox must be configured on different subnets. The minimum configuration includes the external and trusted interfaces. You also can configure one or more optional interfaces.
All computers connected to the trusted and optional interfaces must have an IP address from that network.

For more information, see Mixed Routing Mode.

Drop-in mode

In a drop-in configuration, your Firebox is configured with the same IP address on all interfaces. You can put your Firebox between the router and the LAN and not have to change the configuration of any local computers. This configuration is known as drop-in because your Firebox is dropped in to an existing network. Some network features, such as bridges and VLANs (Virtual Local Area Networks), are not available in this mode.

For drop-in configuration, you must:

Assign a static external IP address to the Firebox.
Use one logical network for all interfaces.
Not configure multi-WAN in Round-robin or Failover mode.

For more information, see Drop-In Mode.

Bridge mode

Bridge mode is a feature that allows you to place your Firebox between an existing network and its gateway to filter or manage network traffic. When you enable this feature, your Firebox processes and forwards all incoming network traffic to the gateway IP address you specify. When the traffic arrives at the gateway, it appears to have been sent from the original device. In this configuration, your Firebox cannot perform several functions that require a public and unique IP address. For example, you cannot configure a Firebox in bridge mode to act as an endpoint for a VPN (Virtual Private Network).

For more information, see Bridge Mode.

Interface Types

When you enable a Firebox interface, you must configure the interface as one of these four interface types:

External Interfaces

An external interface is used to connect your Firebox to a network outside your organization. Often, an external interface is the method by which you connect your Firebox to the Internet.

When you configure an external interface, you must choose the method your Internet service provider (ISP) uses to give you an IP address for your Firebox. If you do not know the method, get this information from your ISP or network administrator.

Trusted Interfaces

Trusted interfaces connect to the private LAN (local area network) or internal network of your organization. A trusted interface usually provides connections for employees and secure internal resources.

Optional Interfaces

Optional interfaces are mixed-trust or DMZ environments that are separate from your trusted network. Examples of computers often found on an optional interface are public web servers, FTP servers, and mail servers.

Custom Interfaces

Custom interfaces are connected to the internal network of your organization. You can use a custom interface when you want to configure a security zone that is separate from the trusted or optional security zones. For more information about custom interfaces, see Configure a Custom Interface.

In mixed routing mode, you can also configure Bridge, VLAN, and Link Aggregation interfaces. Each of these interface types must be in the External, Trusted, Optional, or Custom security zone. For more information about settings that apply to all interface types, see Common Interface Settings.

In mixed routing mode, multiple interfaces of the same type are separate from each other. For example, if you configure multiple Trusted interfaces, hosts on one Trusted network cannot connect to hosts on a separate Trusted network, unless you configure a Firebox policy that allows the connection.

When you configure the interfaces on your Firebox, you must use slash notation to denote the subnet mask. For example, you would enter the IPv4 network range 192.168.0.0 subnet mask 255.255.255.0 as 192.168.0.0/24. A trusted interface with the IPv4 address of 10.0.1.1/16 has a subnet mask of 255.255.0.0.

For more information on slash notation, see About Slash Notation.

Modem Interfaces

Some Firebox models support installation of modems. In Fireware v12.1 and higher, modems are configured as external interfaces with modem failover enabled. Modem interfaces can participate in multi-WAN on Firebox and XTM devices that support multi-WAN. For more information, see About Modem Interfaces.

Modular Interfaces

Some Firebox models support installation of interface modules. You must install an interface module before you can configure the additional interfaces. The numbering of modular interfaces appears similar to other physical interfaces. For Firebox models that support modular interfaces, the interface list also contains a Module column that indicates the port numbers as they are labeled on the front of each interface module.

For more information about modular interfaces, see About Modular Interfaces.

Wireless Interfaces

After you enable at least one wireless access point on a Firebox wireless device that uses Fireware XTM v11.9 or higher, the interface list includes three interfaces that correspond to the wireless access points.

ath1 — Access point 1
ath2 — Access point 2
ath3 — Access Point 3

The settings for these interfaces are the same as the settings you configure for a wireless access point in the Network > Wireless settings.