Example: Route traffic to a specific WAN interface based on the client MAC address

This example routes all data from a certain client device through a cellular WAN based on the device's MAC address, while all other client devices are routed through the Ethernet WAN.

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Create new firewall zones:
    1. Create a firewall zone named CellularWAN with Source NAT enabled:
      1. Click Firewall > Zones.
      2. For Add Zone, type CellularWAN and click .

      3. Enable Source NAT.

    2. Create second firewall zone named EthernetWAN with Source NAT enabled:
      1. For Add Zone, type EthernetWAN and click .
      2. Enable Source NAT.
  4. Configure the WAN interfaces to use the new zones:
    1. Configure the cellular WAN interface:
      1. Click Network > Interfaces > .
      2. For Zone, select CellularWAN.

    2. Configure the Ethernet WAN interface:
      1. Click Network > Interfaces > .
      2. For Zone, select EthernetWAN.
  5. Configure the policy-based route for traffic from the client device that will be sent over the cellular WAN:
    1. Click Network > Routes > Policy-based routing.
    2. Click the to add a new route policy.

    3. For Label, type VoIP phone.
    4. For Interface, select .
    5. Configure the source as the MAC address of the VoIP phone:
      1. Click to expand Source address.
      2. For Type, select MAC address.
      3. For MAC address, type 26:88:0E:23:50:C2.
    6. Configure the destination zone:
      1. Click to expand Destination address.
      2. For Type, select Zone.
      3. For Zone, select CellularWAN.

  6. Create a packet filtering rule that rejects all other LAN packets on the cellular WAN interface.
    1. Click Firewall > Packet filtering.
    2. Click the to add a new packet filtering rule.

    3. For Label, type Reject LAN traffic to cellular WAN.
    4. For Action, select Drop.
    5. For Source zone, select Internal.
    6. For Destination zone, select CellularWAN.

  7. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the EX15 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. Create new firewall zones:
    1. Create a firewall zone named CellularWAN with Source NAT enabled:
      1. Create the firewall zone:
        (config)> add firewall zone CellularWAN
(config firewall zone CellularWAN)>
      2. Enable Source NAT on the new zone:
        (config firewall zone CellularWAN)> src_nat true
(config firewall zone CellularWAN)>
    2. Create second firewall zone named EthernetWAN with Source NAT enabled:
      1. Type .. to move back one node in the configuration:
        (config firewall zone CellularWAN)> ..
(config firewall zone)>
      2. Create the firewall zone:
        (config firewall zone)> add EthernetWAN
(config firewall zone EthernetWAN)>
      3. Enable Source NAT on the new zone:
        (config firewall zone EthernetWAN)> src_nat true
(config firewall zone EthernetWAN)>
  4. Configure the WAN interfaces to use the new zones:
    1. Set the zone for the cellular WAN interface:
      1. Type ... to move to the root of the configuration:
        (config firewall zone EthernetWAN)> ...
(config)>
      2. Set the zone:
        (config)> network interface  zone CellularWAN
(config)>
    2. Set the zone for the Ethernet WAN interface:
      (config)> network interface  zone EthernetWAN
(config)>
  5. Configure the policy-based route for traffic from the client device that will be sent over the cellular WAN:
    1. Add a new routing policy:
      (config)> add network route policy end
(config network route policy 0)>
    2. Set the label that will be used to identify this route policy:
      (config network route policy 0)> label "VoIP phone"
(config network route policy 0)>
    3. Set the interface:
      (config network route policy 0)> interface /network/interface/
(config network route policy 0)>
    4. Configure the source as the MAC address of the VoIP phone:
      1. Set the source type to mac:
        (config network route policy 0)> src type mac
(config network route policy 0)>
      2. Set the MAC address to the MAC address of the VoIP phone:
        (config network route policy 0)> src mac 26:88:0E:23:50:C2
(config network route policy 0)>
    5. Configure the destination zone:
      1. Set the source destination to zone:
        (config network route policy 0)> dst type zone
(config network route policy 0)>
      2. Set the zone to CellularWAN:
        (config network route policy 0)> dst zone CellularWAN
(config network route policy 0)>
  6. Create a packet filtering rule that rejects all other LAN packets on the cellular WAN interface:
    1. Create a new packet filtering rule:
      1. Type ... to move to the root of the configuration:
        (config network route policy 0)> ...
(config)>
      2. Create the packet filtering rule:
        (config)> add firewall filter end
(config firewall filter 2)>
    2. Set the lable to Reject LAN traffic to cellular WAN:
      (config firewall filter 2)> label "Reject LAN traffic to cellular WAN"
(config firewall filter 2)>
    3. Set the action to drop:
      (config firewall filter 2)> action drop
(config firewall filter 2)>
    4. Set the source zone to internal:
      (config firewall filter 2)> src_zone internal
(config firewall filter 2)>
    5. Set the destination zone to CellularWAN:
      (config firewall filter 2)> dst_zone CellularWAN
(config firewall filter 2)>
  7. Save the configuration and apply the change.
    (config firewall filter 2)> save
Configuration saved.
>
  8. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.