We're adding two SonicWALL NSA 2600 firewalls to our current setup. We currently get two WAN connections from two separate Cisco routers running on the same external subnet with what I believe is HSRP. Right now we run these two connections into two Cisco switches, and all of our computers then plug into both switches with NIC teaming.

In the new setup, we'd like to create a 3-port VLAN on each switch, one port for the WAN connection from the Internet and two ports for each NSA 2600. I've got the WAN port setup from one switch to each SonicWALL in HA mode. If I add the second switch connections to X2, I can't figure out how get the bridged in the Network section. If I choose the WAN zone, I just get Static, Wire Mode, and Tap Mode. Static doesn't make much sense, since I'd need to pick a new IP address. Wire Mode will only let me choose unused interfaces (X4 and X5), and Tap Mode looks totally useless.

Does anyone have any tips on how to make this work or where to learn more about getting something like this working (and maintains full redundancy)?

In case a diagram might help someone understand what I'm trying to do:

Network Setup Diagram

Here is what it looked like pre-firewall:

Old Network Setup Diagram

Here are pictures of what I'm seeing on my LAN side:

LAN bridge

Nothing like that seems to exist on the WAN side:

enter image description here

| improve this question | | | | |
  • Jake, thank you for your question; however, you already got an answer on SF. Could you add explicit information in your question about what is lacking so far in that solution? – Mike Pennington Mar 26 '14 at 14:35
  • I was hoping to get an answer that maintains redundancy. The only solution I received there involved adding a single point of failure load balancer, and a colleague commended that this stack might be more appropriate for this networking question. – Jake Braun Mar 26 '14 at 14:46
  • Do you have the High Availability Upgrade license for your NSA firewalls? – Ron Trunk Mar 26 '14 at 16:25
  • @Ron Yes we do, it's setup and works great. Our main problem is getting the redundant WAN connections into both firewalls while maintaining full redundancy. – Jake Braun Mar 26 '14 at 16:41
  • 1
    As stated on SF, the only way you will get around the limitations of Sonicwall is adding a loadbalancer or similar intermediary device. This is a limitation of the Sonicwall firmware. As also suggested you could open a case with Sonicwall. The original question could have been updated to include maintaining redundancy instead of being redundant by asking the question again... – Mike Naylor Mar 26 '14 at 17:35

One option is to connect both switches together and create two vlans that span across both switches. Connect the routers and the WAN side of the FW to VLAN 1. Connect the LAN side and the servers to VLAN 2. If you run HSRP on the routers, that is your default gatewway for the firewall. Here is a logical diagram. Let me know if you need help configuring trunking on the switches.

HA Logical diagram

| improve this answer | | | | |
  • HA for Sonicwalls in this setup would not work for a link failing. There is Failover and Load Balancing on each Sonicwall device that detects down links on each firewall. The HA Pair protects against a Sonicwall Device not being available. It synchronizes settings and checks to see if the other device is up. If the other Sonicwall goes down, the HA Sonicwall picks up the slack. In your diagram if Link 1 fails on the Master Sonicwall, the link for all of the devices on vLAN 2 would still go down as the Secondary Sonicwall will not pick up the workload. – Mike Naylor Mar 26 '14 at 18:40
  • Which link are you talking about? – Ron Trunk Mar 26 '14 at 18:47
  • From vLAN 1 to one of the firewalls. You still have a single link on each firewall. If the link going from vLAN 1 to the primary Sonicwall in the pair, the link will be down for the whole network. Sonicwall HA is to protect against device failure not link failure. – Mike Naylor Mar 26 '14 at 19:02
  • Also if you place a switch in between the Firewalls and the routers you still have a single point of failure. – Mike Naylor Mar 26 '14 at 19:02
  • Creating a trunk also would not work as the WAN connections coming in have distinct IP settings that would need to be configured on the Sonicwall. – Mike Naylor Mar 26 '14 at 19:06

you could use port redundancy on the Sonicwall if it is NSA2600 or above & Sonicos 6.2 and above.


| improve this answer | | | | |
  • 1
    Rather than just posting a URL (as they can expire, move, be deleted/updated etc) can you give a one or two sentences on this feature and why it mightbe of us? – jwbensley Apr 8 '16 at 13:32

Your Answer

