Join the Conversation

To sign in, use your existing MySonicWall account. To create a free MySonicWall account click "Register".


Best Method of Denying Traffic from Specific LAN IPs to Secondary(Failover) WAN

BrianVSTBrianVST Newbie ✭
edited January 2022 in Entry Level Firewalls

Good evening Community,

So here's the situation: We have a site setup to failover to a service with a monthly cap on data usage on X1.

Concern exists that backup appliances on site could cause the site to hit that cap in short order during failover, rendering it useless as a backup.

Needless to say the goal is utilizing the best method to block traffic from those specific devices to the failover WAN port in the event of a failover, if possible.

Now, full disclosure, I have limited experience/knowledge when it comes to Sonicwalls as I've really only been working with them for a couple years. So please pardon any naivety on my part here.

Am I mistaken in thinking that this can be accomplished by setting up an Address Group containing the addresses of the devices we want to deny traffic from and then creating an Access rule set to deny traffic from that Address Group to the failover WAN port?... or am I missing/forgetting something critical?


Category: Entry Level Firewalls

Best Answer

  • Options
    prestonpreston Enthusiast ✭✭
    edited January 2022 Answer ✓

    Hi BrianVST, you will need to use the policy based routing for that address group out of the Primary WAN Interface and un tick the option to disable route if Interface is disconnected, then only everything that is not in the group will use the Primary connection when a WAN failover happens,

    so Route would be presuming X1 is the Primary WAN

    Source (custom address object group)

    Service - ANY

    Destination -ANY

    Interface X1

    Gateway X1 Default Gateway

    Metric 10

    Untick the box for the disable route if interface is disconnected

    Also make sure in the WAN Failover and Loadbalancing you are using logical probing also otherwise it won't know the main interface is down unless someone unplugs it


Sign In or Register to comment.