Watchguard Firewall – bridge a public IP to another interface

We have a xtm21-w and according to the docs in drop-in mode all the interfaces are on the same network.

From the watchguard online docs

In drop-in mode:

• You must assign the same primary IP address to all interfaces on your Firebox or XTM device (external, trusted, and optional).
• You can assign secondary networks on any interface.
• You can keep the same IP addresses and default gateways for hosts on your trusted and optional networks, and add a secondary network address to the primary external interface so your Firebox or XTM device can correctly send traffic to the hosts on these networks.
• The public servers behind your Firebox or XTM device can continue to use public IP addresses. Network address translation (NAT) is not used to route traffic from outside your network to your public servers.

The properties of a drop-in configuration are:

• You must assign and use a static IP address on the external interface.
• You use one logical network for all interfaces.
• You cannot configure more than one external interface when your Firebox or XTM device is configured in drop-in mode. Multi-WAN functionality is automatically disabled.

ping is using ICMP, normally traceroute generates either UDP or ICMP traffic (Unix/Windows difference). Hence, technically you should be able to easily discern diagnostic traffic from application generated one based on protocol used (assuming it's using TCP).

Therefore, it is possible that the routing policy is set to apply only to TCP traffic (as an example). So the statement in your question may be valid. But it would be a specific decision of the administrator. There should be no problem with applying the policy to all traffic, no matter the type, based on IP ranges. So if they wanted, the diagnostic traffic would use the same policy. In fact, I think it would be more reasonable to do so in the first place.

That said, the rep may have some merit, so you shouldn't dismiss him too early. But I would tread carefully, as the other problems you're mentioning (policy triggered when it shouldn't be) mean that probably there are some configuration issues. So it's equally probable that he may indeed not know what he's talking about.