Help in setting DMZ with unusual condition

Why not just configuring those RealIPs as Alias on the WAN Interface of your Sophos XG Firewall, and then NATTING your DMZ Servers via those ALIAS to the Internet?

We actually need the device connected to have a public IP configured.  In this case, NATting shouldn't be needed.  Secondly, the real IPs are not in the same subnet as the ISP's gateway so I'm not sure using it as WAN IP will work.

Ryan,

can you upload a network diagram?

Thanks

Here's a diagram of the relevant parts of the network.

Now there are two ways I can see this configuration going:

1. Bridge ports 1 (LAN) and 3 (DMZ) together and connect the server to port 3. While this may work, I can already see potential security problems with this configuration.
2. Forget about assigning a public IP on the server and instead assign it to another port on the XG. Create a firewall entry to route all ports to internal DMZ server.

Am I getting close?

Here's a diagram of the relevant parts of the network.

Now there are two ways I can see this configuration going:

1. Bridge ports 1 (LAN) and 3 (DMZ) together and connect the server to port 3. While this may work, I can already see potential security problems with this configuration.
2. Forget about assigning a public IP on the server and instead assign it to another port on the XG. Create a firewall entry to route all ports to internal DMZ server.

Am I getting close?

Ryan,

You need to dedicate a physical port to dmz.

Bridging meaning bridge 2 different nics.

Even if you bridge, firewall between zones are needed.

Thanks

HI Ryan,

It would seem you may need to configure Proxy Arp . Could you check the KB article https://community.sophos.com/kb/en-us/123525 for the same . This would suit your desired configuration.