WSM User Guide - WatchGuard Technologies

Installing WatchGuard System ManagerIn a routed configuration, you install the Firebox with different subnets on each of its interfaces. Thepublic servers behind the Firebox can use private IP addresses. The Firebox uses NAT to route traffic fromthe external network to the public servers.The requirements for a routed configuration are:• All interfaces of the Firebox must be configured on different subnets. The minimumconfiguration includes the external and trusted interfaces. You also can configure one or moreoptional interfaces.• All computers connected to the trusted and optional interfaces must have an IP address fromthat network. For example, a computer on a trusted interface in the previous figure could have anIP address of 10.10.10.200 but not 192.168.10.200, which is on the optional interface.Drop-in configurationIn a drop-in configuration, the Firebox is configured with the same IP address on all interfaces. The dropinconfiguration mode distributes the network’s logical address range across the Firebox interfaces. Youcan put the Firebox between the router and the LAN and not have to change the configuration of anylocal computers. This configuration is known as drop-in because the Firebox is “dropped in” to a network.In drop-in mode:• You must assign the same primary IP address to all interfaces on your Firebox (external, trusted,and optional).• You can assign secondary networks on any interface.• You can keep the same IP addresses and default gateways for hosts on your trusted and optionalnetworks, and add a secondary network address to the Firebox interface so the Firebox cancorrectly send traffic to the hosts on these networks.12 WatchGuard System Manager