Deployment scenario in existing Firewall and Peplink Balance Drop in mode with multiple ISP and Publish servers in different WAN connection

[msaspaceike]

Scenario:

1. Existing Firewall have multiple servers publish in every WAN connection.
2. Peplink Balance deployed as Drop in Mode
3. Branch office has pepwave max as Gateway Mode

Condition:

1. No changes configuration in Firewall at Head Office if possible.
2. BO need to access HO LAN and Server network using PEPvpn tunnel and vice versa.

Question:

1. How outside user can access hosted server in multiple WAN behind firewall when in deployed Peplink Balance in Drop in Mode?
2. What configuration needed in PEPvpn to access both network between HO (drop in mode) and BO (gateway mode)?

Please check the link below for your reference in network topology.

NET Topology.jpg

[TK_Liew]

Please refer to the Tips and Tricks and FAQ below to deploy Drop-in.

Deploying Peplink | Pepwave products in Drop-in mode

Drop-in Mode allows Peplink | Pepwave products to be deployed in a network without configuration changes on existing network infrastructure. Example: Pre-Installation In the following network diagram, ISP A provides a 24-bit network 210.10.10.2 / 255.255.255.0, 210.10.10.1 is the default gateway. The Firewall is performing NAT (Network Address Translation) for Local Area Network 192.168.1.0/2 to access the Internet. Firewall settings: NAT Enabled External Interface IP: 210.10.10.2/24 Defau…

Configuring Drop-in Mode

Drop-in Mode is Peplink’s transparent/bridging mode that allows you to seamlessly slot your Peplink into an existing network without having to change configuration on your existing appliances. https://youtu.be/ndG1HCSkZLk When operating, the Peplink forwards traffic between the LAN and the Drop-in Mode WAN without performing any IP address translation/bridging the network. The original firewall/NAT’ing device won’t need any additional configuration/any change in the external IP addresses to wo…

For building SpeedFusion tunnel between HO and BO, please refer to the Tips and Tricks below.

The Quick Guide to Building a SpeedFusion Connection

This guide is meant for customers who wish to experience SpeedFusion as quickly as possible. Requirements To experience SpeedFusion, you need to gain access to two Peplink/Pepwave Routers. If you do not have two Peplink/Pepwave Routers, you can obtain a FusionHub evaluation license. For this example, we will be using a MAX HD2 (device A) on one end and a FusionHub (device B) on the other. Configuring Device A 1) Copy the serial number from Device B (FusionHub in this case) [2013-12-19_173726] …

Please contact local Peplink partner if you need further help of the deployment.

[msaspaceike]

Hi TK_Liew,

1. I got it but what will happen to my server that are published on various internet connection since the connection between the firewall and the peplink is only one WAN connection and the rest are connected in Peplink Balance. Please check the link below for your reference network topokogy.

community.jpg

2. How we can reach HO lan and server network from BO site if the peplink is in Drop in Mode and those network are after the firewall?

[Ron_Case]

1. The firewall uses a single outside interface with a drop-in mode deployment. The other WAN connections will get a NAT from the Peplink to the outside IP address(es) of your firewall. The firewall uses the same default gateway of the primary ISP router.

2. Two steps are needed for this:

a) LAN static routes are configured in the Balance for the HO internal networks, pointing to the outside interface of the firewall.

b) The Firewall has NAT exemption policies so there is no NAT when source = internal networks and destination = branch office LAN. The NAT exemption policies are also configured for the reverse direction.