Skip to main content
Nurgle
Nurgle
New Member
June 24, 2025
Question

Bridge ISP subnet to endpoints using FortiGate

  • June 24, 2025
  • 1 reply
  • 1336 views

Hey!

 

Sure my topic is a no-brainer for most here, but bare with me as this is all really new to me.

I've got an assignment to take a subnet from our ISP and bridge/distribute it endpoints in a LAN.

In the LAN some are in need of external IP's and some are not. Those who don't need externals

I can handle fine with simple NAT. 

However I'm alittle lost as to what to do with the external ones and how do I make the FortiGate play along.

The endpoints set a static ip we agree on from the ISP subnet and I need to organise the endpoints flow

correctly with the FortiGate, but this is where I'm at a loss. Like what steps to take and so on. Any help would be much appreciated!

Using FortiLink if that makes any difference by the way.

 

Thanks!

1 reply

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
June 24, 2025

How the ISP subnet is delivered? Like an additional /29 delivered over a /31 or /30 circuit?

Toshi

Nurgle
NurgleAuthor
New Member
June 25, 2025

Can't tell at the moment as we've not gotten the delivery yet, I just know the subnet is about to be ordered and I'd like to be prepared. But yes that seems very likely I'd say, an additional /28 over a /30

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
June 25, 2025

Then simply assign the new /28 on your LAN side interface. One of them as FGT's interface IP, which would become the GW for devices in the subnet.
To have both public and private subnets on the same broadcast domain, you can configure a secondary IP for either of them on the same interface. 
The tricky part is DHCP and policies. Only one of them can have DHCP because both are sharing the same boradcast domain (DHCP Discover/Request). You likely have to use static IPs for public then use DHCP for devices in the private subnet.
For policies, you need to specify the souce subnet to separate them par subnet. Obviously you have to NAT for private subnet and no NAT for public subnet.

Toshi

Terms & ConditionsAccessibility statement