Member Avatar for inavas

Hi,

Recently I've installed a cisco firewall on my network (model isa550). But I have a problem. On my network I have optical fiber so the ethernet cable goes from the optical network termination to the router. Where I have to connect the firewall? I mean.. the WAN port of the router is busy.. so.. I have to connect the firewall to a LAN port? (the router is a comtrend).

The fact is that I have connected the firewall to a LAN port of the router.. but it doesn't works as it should.

If anyone has any idea please tell me :)

Thanks!

  • 3 Contributors
  • 3 Replies
  • 242 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by CimmerianX

Dani AI

Generated

Brief diagnosis and direction: the behavior described by is classic bypass — the router still provides a direct path to the Internet for LAN hosts so the Cisco box never becomes the mandatory hop. As recommended, start with basic connectivity checks; as noted, the firewall must be placed inline (or the router put into bridge/DMZ mode) so all LAN→WAN traffic flows through the firewall.

Practical checklist to fix and verify the setup:

  • Topology: make the firewall the only path between LAN and router (Router LAN -> Firewall WAN; Firewall LAN -> switch -> hosts). Remove any second link from the router into the firewall LAN that creates a shortcut.
  • IP plan: use a dedicated subnet for the router↔firewall link and a different subnet for the firewall↔LAN. The firewall LAN address must be the LAN default gateway distributed by DHCP (or assigned to hosts).
  • DHCP/NAT: disable or reconfigure the router’s DHCP so the gateway it hands out is the firewall LAN IP. Avoid double NAT — ideally let the firewall perform NAT or put the router in bridge mode so the firewall receives the public address.
  • Tests: with a single test client given a static IP and the firewall as gateway, run ping/traceroute and observe the firewall packet capture/logs to confirm traffic hits the firewall and ACLs are matched.

Additional troubleshooting notes: overlapping subnets, an extra physical link, or ACLs applied to the wrong interface/direction will let traffic bypass inspection. Router-side features (NAT, proxy, or UPnP) can also hide flows from the firewall. Enabling firewall logging and a short capture during a client test will quickly show whether packets arrive on the firewall’s WAN interface and whether ACLs or NAT rules are being hit. A single isolated test host is the fastest way to prove the correct inline behavior before changing DHCP or switching production hosts.

Recommended Answers

All 3 Replies

Member Avatar for JorgeM

If the router is functioning as your perimeter device connecting your WAN to your LAN, yes I'd see the firewall connected to your LAN port since the WAN port is being connected to your provider.

What exactly doesn't work? Did you set up the interfaces correctly on the router and firewall? Can you at the very minimum ping the firewall interface from the router?

Member Avatar for inavas

Hello, thanks for your answer!

I'll try to explain myself better than before:
What doesn't work is that the firewall doesn't filters the traffic. I mean, the traffic gets into the firewall but instead of going out for the WAN port, it goes out for the LAN port to the router.

Firewall:
WAN port goes to a LAN port of the router. (this isn't working, this should filters the traffic but it doesn't).
LAN port goes to another LAN port of the router (this catches internet from the router)
LAN port that goes to another switch that has computers.

Router:
WAN that goes to the ONT (optical network termination)
LAN that goes to the WAN port of the firewall.
LAN that goes to a LAN port of the firewall.

All the computers has internet because of the connection LAN(firewall)-LAN(router) but the firewall doesn't filters anything.. I don't know what to do..

Do you have any idea?

Thanks a lot.

Member Avatar for CimmerianX

Usually, an in line firewall would sit between the router and internal lan such that:
Router -> Firewall WAN port -> Firewall -> Firewall LAN port -> internal lan.

All internal hosts would use the Firewall LAN port as the new default gateway. You would want to setup a new subnet for the router to firewall connections so it is distinct from the inside network.

You could also setup a "Firewall on a stick" where 1 connection to the router has 2 vlans defined and traffic is separated that way.

Did you take jorgeM's advice and do basic ping tests?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.