Something I did recently using a SSG 20 with commercial T1 and Comcast and both default virtual routers. (You don't have to use two virtual routers, but here's why I did this at first). Initially, my client reported that Comcast was assigning DHCP to the firewall's interface. When DHCP is used, the default route created from DHCP cannot be modifed and will show up as a directly connected route, so it will have a higher metric (unless you modify your preference / metric settings, but I have not tried that) So, if Comcast is supposed to be the backup route, placing it in the untrust-vr and controlling traffic in the trust-vr worked great. This works fine with a static IP as well. Here we go: Here are the default zones in the default trust-vr. set zone "Trust" vrouter "trust-vr" set zone "Untrust" vrouter "trust-vr" I created a new custom zone and placed it in the untrust-vr set zone id 101 "Comcast" set zone "Comcast...
Random nerdling things for network engineering, scripting, and whatever else I find interesting to share.