Stumped by the mask in topology

[Frater]

Hi all.

I'm trying to use an Edge-X32 as a branch office firewall with partial luck.
The Wan interface connects to an internet broadband router while DMZ does what its for and the Lan port points toward the office network and then on to the corporate WAN.
It is managed by a Smartcenter NGX R61 server sitting on the corporate WAN.
Connecting the Edge to Smartcenterbut works fine, but when I assign an IP to the Edge box it ends up with a host mask (255.255.255.255).
Since I want it to be a routing firewall I want all interfaces to have Class-C masks.

What am i missing?

[kva.kva]

Do you mean mask for SmartCenter object? I think it's feature, you cannot change mask for Edge object. I didn't have any troubles with it.

[Frater]

It looks strange in smartmap since it adds a single host network segment to an existing class-c network. which looks like it will make a mess of routing.
Besides, when I create the Edge object in smartcenter, should I use the internal adress or the "external" wan IP?

[kva.kva]

You should use WAN IP if it's static. And you can use Dynamic address if WAN address is changed periodically or if IP is "private" (for example from small network range between your Edge and xDsl modem).

[Frater]

Attached is a picture of the installation, it is what I had in mind when building the setup.
Is this till possible with the host mask "feature" in the Edge?

[kva.kva]

Hm, interesting configuration. Why do you connect SC on Edge's LAN but not through Broadband router?

[Frater]

Because we have several wan connected branch offices with their own internet connections.
Local internet access its cheap but not very dependable, it suffices for web surfing and the like.
Hence the wan connections for handling internal services, that way I wont have to put my SC or mgt traffic near any unclean networks..

This solution works great with branch firewalls running Splat, but they are quite expensive compared to Edge boxes.

[kva.kva]

I think you can use vpn between splat and edges in your case. Also all connections between CP modules and SmartCenter are secured.
When you connect to Service Center, you input key like Registration Key in Edge's properties. This key is used to ensure secure communications between the SmartCenter and the Edge. In the event that the VPN tunnel is established using IKE pre-shared secrets as the authentication method, this password is used as the pre-shared secret.

[Frater]

Well sure I can, If I were to roll out completely new branch offices, which I am not...
What I have is small branch offices with WAN connections and local internet access for websurfing protected by crappy dsl routers.
What I need is to reinforce security in these offices with cost effective firewalls, Edge boxes for instance.

So is it possible to manage them though the Lan interface instead of over the internet?
(I can live with have weird subnet mask settings on the outside interface.)

[kva.kva]

Try to test your scheme. 1'st try to use LAN IP in object's properties. I don't think that will be problem with mask, because Edge has correct IP and masks in its "web" configuration. But I see another possible problem with networks behind LAN interface. May be you'll get Spoofing errors.

[Frater]

Using the Lan IP gives all kinds of problems since the Edge implementation in SC is hardwired to use the object IP as the internet facing port.

However, I finally got inside management to work as I intended after a brief discussion on the sofaware forum.
Check link here: http://sofaware.infopop.cc/eve/forum...1/m/3891087214

After updating SWManagementServer.ini on the SC server i had no grief from the Edge box over managing from the Lan int.

I did a manual hack for the host mask prob by editing objects_5_0.C, that way I have a proper C mask for the outside as well.
The stability of that hack is for the future to show, I guess I will have to perform it for every Edge box I set up in this fasion...

Lets hope this keeps working. =)