2.2 Network Operating Modes

2.2 Network Operating Modes

A fundamental architectural decision when configuring a WatchGuard Firebox is selecting the Network Operating Mode. The operating mode dictates how the Firebox handles Layer 2 Ethernet frames and Layer 3 IP packets as they traverse physical ports. It determines whether the appliance functions as a full Layer 3 multi-port router, a transparent inline filter sharing a single IP subnet, or a pure Layer 2 security sensor that is invisible to adjacent network devices.

Fireware OS supports three distinct operating modes:

1. Mixed Routing Mode (the default and standard mode)
2. Drop-In Mode
3. Bridge Mode

Choosing the appropriate operating mode requires balancing the desire for seamless deployment into existing network topologies against the need for advanced networking features such as Multi-WAN load balancing, dynamic routing protocols, and virtual private network termination.

---

Mixed Routing Mode (Default Layer 3 Architecture)

Mixed Routing Mode is the default, most versatile, and most widely deployed operating mode in Fireware OS. In this mode, the Firebox operates as a fully functional Layer 3 security router and multi-zone firewall.

                               MIXED ROUTING MODE
+-----------------------------------------------------------------------------------+
|  - Each interface belongs to an independent, non-overlapping IP subnet.          |
|  - Full Layer 3 routing, policy enforcement, and proxy inspection.                |
|  - Supports Dynamic NAT, 1-to-1 NAT, Static NAT (SNAT), and Multi-WAN.           |
|  - Terminates Mobile VPN and Branch Office VPN (BOVPN / BOVPN VIF) tunnels.        |
+-----------------------------------------------------------------------------------+

    [External eth0]       [Trusted eth1]       [Optional eth2]       [VLAN 10 Trunk]
     198.51.100.2/24       10.0.1.1/24          172.16.1.1/24         10.0.10.1/24
            |                   |                     |                     |
        (Internet)        (Corporate LAN)           (DMZ)             (Finance Dept)

Key Architectural Principles of Mixed Routing Mode

• Subnet Separation: Every configured interface (External, Trusted, Optional, Custom, and virtual VLAN interfaces) must be assigned an IP address residing within a distinct, non-overlapping IP subnet. The Firebox acts as the default gateway for client devices residing in each attached broadcast domain.
• Full Routing Capabilities: The Firebox maintains an active IP routing table. It supports static routes, equal-cost multi-path (ECMP) routing, policy-based routing, and enterprise dynamic routing protocols including OSPFv2/OSPFv3, BGP4, and RIPv1/v2.
• Comprehensive Multi-WAN Support: Mixed Routing Mode is the only operating mode that supports Multi-WAN — WatchGuard documents that multi-WAN "does not operate in drop-in or bridge mode network configurations." At least two interfaces must be configured as External to participate, and administrators can then apply the Routing Table, Round-Robin, Failover, or Interface Overflow methods as well as SD-WAN path selection.
• Full NAT Flexibility: Supports all forms of Network Address Translation, including Dynamic NAT (many-to-one and many-to-few), 1-to-1 NAT (bidirectional subnet mapping), Static NAT (SNAT port forwarding and server load balancing), and NAT loopback.
• VPN Termination: The Firebox can terminate all supported Mobile VPN protocols (Mobile VPN with SSL, IKEv2, and L2TP) as well as site-to-site Branch Office VPN (BOVPN) tunnels and route-based BOVPN Virtual Interfaces (VIF).
• High Availability (FireCluster): Supports both Active/Passive failover and Active/Active load-sharing FireCluster configurations.

---

Drop-In Mode (Inline Transparent Subnet Insertion)

Drop-In Mode allows an administrator to install a Firebox inline between an existing router and an existing local network without altering the IP addresses of any computers, servers, printers, or the default gateway router.

                                  DROP-IN MODE
+-----------------------------------------------------------------------------------+
|  - ALL interfaces share the EXACT SAME IP address and subnet mask.                |
|  - Firebox inserts transparently between the existing router and switches.        |
|  - Existing hosts maintain their original IP and default gateway settings.        |
|  - NO Multi-WAN, NO VLANs, NO dynamic routing, NO link aggregation.             |
+-----------------------------------------------------------------------------------+

               [Existing Edge Router / Gateway] (IP: 203.0.113.1/24)
                              |
                     (External eth0)
                   [ Firebox in Drop-In ]  <--- Firebox IP: 203.0.113.2/24
                     (Trusted eth1)             (Configured on ALL interfaces)
                              |
                 [Existing Core LAN Switch]
                              |
     +------------------------+------------------------+
     | (Server 1)             | (Server 2)             | (Workstation)
     203.0.113.10             203.0.113.20             203.0.113.50
     GW: 203.0.113.1          GW: 203.0.113.1          GW: 203.0.113.1

How Drop-In Mode Works

In Drop-In Mode, the administrator assigns a single primary IP address and subnet mask to the Firebox. This exact IP address and netmask are applied across all physical and virtual interfaces on the device (External, Trusted, and Optional).

• Transparent Forwarding: The Firebox intercepts ARP requests and monitors MAC addresses traversing its ports. When a host on the Trusted interface transmits a packet destined for the existing router's gateway IP on the External interface, the Firebox evaluates the packet against its firewall policies, proxies, and security subscription services. If permitted, the Firebox forwards the frame out the External interface without modifying the Layer 3 source or destination IP addresses.
• Secondary Networks: If the physical network segment carries multiple secondary IP subnets, Fireware allows administrators to configure secondary IP networks on individual interfaces in Drop-In Mode.

Strict Limitations of Drop-In Mode

While Drop-In Mode simplifies initial insertion into flat networks, it introduces severe architectural constraints that frequently make it unsuitable for long-term enterprise use:

1. No Multi-WAN: Because all interfaces share a single IP address and default gateway, Drop-In Mode supports only one External interface. An organization cannot deploy secondary ISP links for WAN failover or load balancing.
2. No Dynamic Routing: OSPF, BGP, and RIP dynamic routing daemons are completely disabled.
3. FireCluster Restrictions: An active/active FireCluster cannot be configured when the network is in drop-in mode. WatchGuard documents drop-in and bridge mode as unsupported network modes for active/active clusters.
4. VLAN Restrictions: A Firebox in drop-in mode "cannot route VLAN tagged traffic."
5. Interface Bridging Restrictions: Physical interfaces cannot be bound into custom Layer 2 bridge groups.

[!WARNING] Drop-In Mode Use Case Evaluation: Drop-In Mode is primarily intended as a temporary deployment mechanism or for legacy environments where re-addressing hundreds of statically configured servers is cost-prohibitive. In modern architectures requiring resilient multi-homed Internet connections, Mixed Routing Mode is strongly preferred.

---

Bridge Mode (Pure Layer 2 Security Sensor)

Bridge Mode configures the Firebox as a transparent Layer 2 filtering bridge (often termed a "Bump-in-the-Wire" device). In this mode, the Firebox processes traffic strictly at the Data Link Layer (Layer 2), inspecting frames as they cross between bridged physical ports while remaining completely invisible to adjacent Layer 3 routers and switches.

                                  BRIDGE MODE
+-----------------------------------------------------------------------------------+
|  - All interfaces are bridged; the Firebox itself holds ONE system IP address.     |
|  - Passes Ethernet frames transparently without modifying MAC or IP headers.      |
|  - Full stateful inspection, deep packet proxies, and security services.          |
|  - System IP set statically, or by DHCP plus a private management IP address.      |
|  - NO routing, NAT, VPN, Multi-WAN, VLANs, static routes, DHCP, or FireCluster.    |
+-----------------------------------------------------------------------------------+

            [Upstream Enterprise Router / Gateway] (IP: 10.50.0.1/16)
                         |
                (Bridged interface: Inbound)
             [ Firebox in Bridge Mode ]  <=== System IP: 10.50.0.9/16
                (Bridged interface: Outbound)     (Used ONLY for Web UI, WSM, Logs)
                         |
             [Downstream Distribution Switch] (IP: 10.50.0.2/16)

How Bridge Mode Operates

• No Per-Port Layer 3 Addressing: The interfaces participating in the bridge do not each carry their own IP address or default gateway. They do not respond to ARP requests for transit traffic and do not alter Ethernet MAC headers or IP TTL (Time to Live) values.
• A Single System IP Address: Instead of a dedicated physical management port, the Firebox itself is given one system IP address on the bridged network, along with the IP address of the gateway device. That address must be on the same subnet as the network the Firebox is inserted into, and administrators use it for the Fireware Web UI, WatchGuard System Manager (WSM), the CLI on port 4118, and for outbound log and subscription-service traffic.
• DHCP and the Management IP Address: The system IP can also be obtained by DHCP from the gateway device. WatchGuard documents that when you choose DHCP you must also specify a management IP address in a private IP address range: if the DHCP server fails to assign a system IP address, or you do not know which address it assigned, you connect to the Firebox with that management IP address.
• Full Security Inspection: Even though the Firebox does not route packets, it reconstructs Layer 3 packets and Layer 4/7 sessions from the passing Layer 2 frames. It enforces full stateful packet inspection, applies application proxies (HTTP/HTTPS, SMTP, DNS, FTP), and runs all licensed subscription services including Gateway AntiVirus (GAV), Intrusion Prevention Service (IPS), WebBlocker, APT Blocker, and Application Control.

Strict Limitations of Bridge Mode

Because the Firebox operates strictly at Layer 2 without routing capabilities, Bridge Mode imposes the most stringent feature limitations in Fireware:

• No Layer 3 Routing: Cannot route packets between disparate IP subnets.
• No NAT Support: 1-to-1 NAT, dynamic NAT, and static NAT (SNAT) are all unavailable.
• No VPN Endpoints: The Firebox cannot act as a VPN endpoint or gateway. (It can, however, pass transit IPSec or SSL traffic traversing the bridge if permitted by policy).
• No Multi-WAN: Cannot connect multiple WAN circuits or perform link failover.
• No DHCP Services: Cannot act as a DHCP server or DHCP relay agent.
• No FireCluster: WatchGuard lists FireCluster among the functions a Firebox cannot perform in bridge mode. High availability therefore requires mixed routing mode (or drop-in mode for an active/passive cluster).
• Other Unavailable Functions: VLANs, network bridges, PPPoE, link aggregation, static routes, secondary networks, modem failover, dynamic routing (OSPF, BGP, RIP), some proxy functions including the HTTP Web Cache Server, authentication automatic redirect, wireless client configuration on built-in wireless Fireboxes, AP management through the Gateway Wireless Controller, Network Discovery, and DNS forwarding (except for DNSWatch enforcement).
• Spanning Tree Protocol (STP) Considerations: When deploying a Firebox in Bridge Mode within a switched network running Spanning Tree Protocol (STP / RSTP / MSTP), the Firebox forwards Bridge Protocol Data Units (BPDUs). Network engineers must verify that the bridge does not inadvertently trigger topology change notifications (TCNs) or form redundant Layer 2 loops that cause broadcast storms.

---

Comprehensive Operating Modes Decision Matrix

The following matrix summarizes the technical capabilities, architectural behaviors, and feature compatibilities across the three Fireware operating modes: