Configure 240D for Dedicated Server Hosting

let me re-play what I think you want to do. You have 64 internet routable addresses, which means say about 29 hosts you can have in use (since you want to allocate each one a separate address for the management interface you use two addresses, and you don't actually get 32 addresses in a /27, you only get 30 usable and I assume you may want a dedicated IP for your own management; if you have a /26 range rather than two /27's you get an extra two usable IPs).  What you want to do is protect the other tenants from someone who changes the IP address on their hosted server or their hosted server management connection, so it doesn't cause an outage or intercept traffic meant for another tenant.  Did I get that reasonably correct? 

 

I'm a bit old school so may not have new and fresh ideas that FGTs are capable of, and I'm not going to give you a complete security solution here, but here's how I'd approach it in a simple to understand solution. At the fortigate perimeter, you're going to have a set of IPs defined on the WAN. You'll then have NATs that translate traffic from the external IP address to the assigned internal IP addresses (10.x or your choice of non-routables). On the inside, I'd be using VLANs so that you don't get any chance to jump addresses through random guessing of IP, subnet, and gateways. You hard allocate a host to a VLAN (through cabling) and give it some fixed IP addresses, and if the server manager decides to change the IP address then they lose access to the box. if they move the IP from say 10.0.0.5 to 10.0.0.6, the external NAT no longer works; if they move the IP to 10.0.1.5 then the VLAN trips them up and they don't block the neighbour's server that lives on that IP address and can't absorb traffic that wasn't meant for them.

To permit inbound access you'd have a set of VLAN interfaces on the FGT and each tenant's policy ruleset would permit traffic from WAN to their VLAN (and only their VLAN).