Static vs Policy Routes for Multiple WAN and DMZ Interfaces

[create_share]

Hi,

I have two WAN Interfaces and two DMZ Interfaces. I need my Internal LAN users to use WAN1 for Internet Access and WIFI users who are also connecting from the LAN Interface but with different IP Subnets should use WAN2 for Internet Access.

Does the Firewall automatically create Static Routes for the WAN Interfaces as default routes or they must be created manually? I have created two routes like this:

Route for LAN Users:

Destination: 0.0.0.0/0.0.0.0

Gateway: WAN1 Gateway

Interface: Port2

Administrative Distance: 10

Priority: 1

Route for Wifi Users:

Destination: 0.0.0.0/0.0.0.0

Gateway: WAN2 Gateway

Interface: Port3

Administrative Distance: 10

Priority: 1

What should be the administrative distance and the Priority for both Static Routes?

Do I also have to create Policy Routes for both the WAN Interfaces to forward the traffic through different WAN Interfaces?

Secondly, I need to forward some traffic through the DMZ Interfaces. Is it possible to add a group of subnets under the Static Route destinations instead of a single subnet?

Thanks.

[srajeswaran · Accepted solution]

Hello @create_share ,

Below given are the possible answers for your questions.


Does the Firewall automatically create Static Routes for the WAN Interfaces as default routes or they must be created manually? I have created two routes like this:

>> Static route need to be created manually. If you are using WAN interfaces as DHCP clients, then the ISP may push the IP and a defulat route, in that case you don't need to configure static route. The configured routes look good.

What should be the administrative distance and the Priority for both Static Routes?
>>>>It should be same so that both routes are active on the route table

Do I also have to create Policy Routes for both the WAN Interfaces to forward the traffic through different WAN Interfaces?
>>>Yes, you need policy routes for specific source subnets to go through different WAN interfaces.


Secondly, I need to forward some traffic through the DMZ Interfaces. Is it possible to add a group of subnets under the Static Route destinations instead of a single subnet?
>>> No, we cannot add multiple destinations to one static route. You need to configure multiple routes or use a supernet as destination.

[create_share]

Thanks.