Skip to main content
FirewallNoob
FirewallNoob
New Member
April 18, 2017
Solved

Basic New Setup IP Question

  • April 18, 2017
  • 1 reply
  • 11128 views

Hello,

 

I am adding a new IP range to our WAN1 port and came across a weird issue/confusion on how the fgt is defining these fields in the GUI. I am probably overthinking it, but are we supposed to put in the full Assigned LAN Netblock address with /28 the IP assigns me in the fgt Network/Interfaces/edit WAN1 "IP/Netmask" field, or just the first LAN Usable IP (205.105.155.146/255.255.255.240 - or 255.255.255.255)? Same goes for my static routes. The ISP gave me a Default Gateway for LAN Netblock to use - that should be my static route, correct? 0.0.0.0/0.0.0.0 as the IP/Mask and 205.105.155.145 for the Gateway under Router/Static/Static Routes?

 

Example of what we were provided, including explanation from ISP:

Assigned LAN Netblock  - 205.105.155.144/28

Subnet Mask: 255.255.255.240

LAN Usable IPs: 205.105.155.146 through 205.105.155.158

*You mas assign these IPs to your LAN (LAN Default Gateway, PC, Workstation, Firewall, etc)

Default Gateway for LAN Netblock: 205.105.155.145

*This will be the IP that all devices use as a default route or gateway for your LAN back to your router.

 

Config is ISP > 100Mbit managed Adtran router in bridged mode > WAN1 of FGT > flat HP network switch. No VLANs or anything.

 

Thanks!

    Best answer by rwpatterson

    neonbit wrote:

    You would configure your wan1 interface with the address 205.105.155.146/28.

     

    Your default gateway would be 0.0.0.0/0 and 205.105.155.145 as the gateway address.

    More clearly, the IP address could be anything BUT 205.105.155.145 because that is the default gateway. The route should be 0.0.0.0/0. And the gateway IP is 205.105.155.145.

    1 reply

    rwpatterson
    rwpatterson
    New Member
    April 19, 2017

    You assign the interface a single address in the correct subnet. The other addresses in the range need to be assigned Virtual IP addresses (VIPs for short) from the Fortigate. The Fortigate will answer requests to these IPs and pass the traffic to the NATted device on the other side.

    FirewallNoob
    FirewallNoobAuthor
    New Member
    April 19, 2017

    Thank you RW, that seems clear. But, what should those numbers be in my example?

    I am not a network engineer but noticed (we have two) fortigates..one uses the first addressable IP at the IP/Network mask and another uses the 3rd IP/Network mask. Furthermore, one uses an unusable Default gateway for a static route and another uses the last IP in the usable range?

     

    What gives?

    What is best practice?

     

    Thank you for any help - these Fortigates are unconventional to me in terms of how they define these interfaces, wizards and help lookup. Cisco - no problem. Very clear. 

    neonbit
    neonbit
    New Member
    April 19, 2017

    You would configure your wan1 interface with the address 205.105.155.146/28.

     

    Your default gateway would be 0.0.0.0/0 and 205.105.155.145 as the gateway address.

    Terms & ConditionsAccessibility statement