Athena NGFW (Next-Generation Firewall)

Athena NGFW (previously known as Network Secure) provides comprehensive protection for every network perimeter, ensuring the safety of your valuable assets, data, and users from emerging threats.
{{ $t('productDocDetail.guideClickSwitch') }}
{{ $t('productDocDetail.know') }}
{{ $t('productDocDetail.dontRemind') }}
8.0.107
Athena NGFW (Next-Generation Firewall) {{ breadTitle }} Deployment Deployment Mode Routing Mode (Layer 3)
{{sendMatomoQuery("Athena NGFW (Next-Generation Firewall)","Routing Mode (Layer 3)")}}

Routing Mode (Layer 3)

{{ $t('productDocDetail.updateTime') }}: 2026-02-05

A typical application environment for routing deployment is to deploy a Athena NGFW device in the routing mode at the Internet port as a proxy of the LAN. The device is deployed like a router in the network. The WAN port is connected to the ADSL dial-up or Internet line, while the LAN port is connected to the LAN switch.

Deployment Case of Routing Mode

An enterprise network is a layer 3 environment. It is planned to deploy the Athena NGFW device at the Internet port as a proxy of the LAN. The Internet line is connected to the fixed IP address via optical fiber, as shown below:

Step 1.Log in to the device through the default IP address of the management interface (ETH0). The default IP address of the management interface is 10.251.251.251/24. You need to configure an IP address in the same network segment on the computer and log in to the device via https://10.251.251.251.

Step 2.Configure the WAN interface: Click the interface to be set as the WAN interface through Network > Interfaces > Physical Interfaces. Select eth2 as the WAN interface, select Layer 3 for Type and the WAN for Zone, check the WAN attribute checkbox, and configure an IP address 1.2.1.2/29 and the next-hop address 1.2.1.1, etc. See the figure below:

1. The next-hop gateway of an interface is only applied to the link detection and policy-based routing functions. Setting the next-hop gateway does not generate a 0.0.0.0/0 default route on the device. Therefore, you need to configure the default route.

2. The line bandwidth setting of an interface is not associated with traffic management, and the line bandwidth setting at the interface is used for scheduling policy-based routing.

Step 3.Configure the LAN interface: Select eth3 as the LAN interface, and click the interface name to go to the configuration page. Select Layer 3 for Type and define the Zone as LAN zone, and configure an IP address 192.168.1.254/24, as shown below:

Step 4.Configure a route: You need to configure a default route to 0.0.0.0/0.0.0.0, pointing to the next hop 1.2.1.1. Meanwhile, the LAN interface is connected to multiple network segments across layer 3. In this case, you need to configure another static route containing each network segment to the layer 3 switch. Go to Network > Routes > Static Routes and click Add to add a static route.

Configure the default route Dst IP/Netmask as 0.0.0.0/0 and the Next-Hop IP as 1.2.1.1, and configure the return route (LAN segment return route) Dst IP/Netmask as 192.168.2.0/24 and the Next-Hop IP as 192.168.1.1. See the figure below:

Step 5.Configure the SNAT: Go to Policies > NAT > IPv4 NAT. Click Add to configure the SNAT. Select the custom LAN zone as the Src Zone, the custom LAN address as Src Address, the custom WAN zone as Dst Zone, All for Dst Address, any for Services, and Outbound Interface for Translate Src IP To. See the figure below:

Step 6.Configure the application control policy: Assign the Internet access permissions to LAN users. Go to the Policies > Access Control > Application Control page. Click Add. Assign the LAN-WAN data access permissions. Then, select the custom LAN zone as the Src Zone, the custom LAN address as Src Address, the custom WAN zone as Dst Zone, All for Dst Address, any for Services, and All for Applications. See the figure below:

Step 7.After completing the basic configuration, connect the device to the network, the eth2 interface to the optical fiber, and the eth3 interface to the layer 3 LAN switch.

1. When the device is working in the routing mode, the gateways of PCs on the LAN are directed to the IP address of the LAN interface or the layer 3 switch, with the gateway of the layer 3 switch directed to the device. Internet access data is subject to NAT by the device or is forwarded via the route by the device.

2. When the device has multiple routing interfaces, it can use the IP address of the same network segment. The static route will determine the networking interface from which data will be forwarded.

3. The device supports routing interfaces configured with multiple WAN port attributes to connect to multiple external network lines, but authorization to open multiple lines is required.