Network Configuration, Interfaces, and Routing
Interface types
Firebox interfaces are labelled by trust level: External (untrusted, usually internet), Trusted (protected LAN), Optional (DMZ or extra segments) and Custom (user-defined trust level for granular rules). Each interface gets an addressing mode - static, DHCP client or PPPoE - plus optional secondary networks that add extra subnets to the same physical port without a VLAN.
VLANs, bridge interfaces (two ports acting as one L2 segment) and link aggregation are configured under Network > Interfaces. A DHCP server or relay can be enabled per interface.
Routing and multi-WAN
- Static routes: destination/prefix to a gateway on a chosen interface. The default route is 0.0.0.0/0; when several candidates exist, the lowest metric wins.
- Policy-based routing (PBR) overrides the route table for matching traffic and forces it out a specific external interface.
- Multi-WAN combines External interfaces using failover (priority order) or round-robin (load sharing), with link monitors - probe targets and thresholds - that detect a dead link.
- Dynamic routing: RIP and OSPF, and BGP on supported models, configured per interface.
Traps
Forgetting that a new subnet needs both a route and a policy. Changing the addressing of the interface you are connected through and locking yourself out. Expecting multi-WAN failover to work with no link monitor configured. Treating secondary networks as VLANs.
Rule of thumb: when traffic goes the wrong way, check in order - interface address/gateway, then the route table in FSM, then the policy From/To and any PBR action.