Skip to main content
ForgetItNet
ForgetItNet
Explorer II
May 13, 2022
Solved

Force internal IP out of secondary WAN IP

  • May 13, 2022
  • 1 reply
  • 3718 views

Hi all,

I have searched for this in the forum and internet without much success so just wanted to clarify that i AM doing this the right way.

I've got a WAN connection (say 1.1.1.1) and i've got an internal IP of a device on 192.168.70.50. I have added a secondary IP to that WAN interface of 1.1.1.2 and i want to route the 192.168.70.50 out of that ip (1.1.1.2) so i've added a policy route with the incoming interface as the Data Internal interface (which is what the 192.168.70.50 is connected to) and a source address of 192.168.70.50/255.255.255.255, then a destination address of 0.0.0.0/0.0.0.0 and in the outgoing interface i've selected the WAN interface and then set the gateway address as 1.1.1.2 ?

I've ran packet trace and i can see packets coming INTO 1.1.1.2 to 192.168.70.50 but nothing going out.

Have i configured this correctly or am i missing anything ?

I'm not that familiar with Fortigate products (model is a 60E on V7 software by the way)

Thanks all

Best answer by pminarik

Hi ForgetItNet,

 

"Gateway" is the IP of the next-hop (presumably the IPS router/modem), so that would not be correct if the 1.1.1.2 IP is "owned" by your device on the WAN interface.

What you should do instead is create a new IP pool, set it to the "range" 1.1.1.2-1.1.1.2, and then in the appropriate firewall policy for the client 192.168.70.50 you enable source NAT and switch it to using your new IP pool (instead of the default option "use outgoing interface IP").

 

Here's some older, but still good, documentation:

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/476781/ipv4-pools

 

1 reply

pminarik
Staff
pminarikAnswer
Staff
May 13, 2022

Hi ForgetItNet,

 

"Gateway" is the IP of the next-hop (presumably the IPS router/modem), so that would not be correct if the 1.1.1.2 IP is "owned" by your device on the WAN interface.

What you should do instead is create a new IP pool, set it to the "range" 1.1.1.2-1.1.1.2, and then in the appropriate firewall policy for the client 192.168.70.50 you enable source NAT and switch it to using your new IP pool (instead of the default option "use outgoing interface IP").

 

Here's some older, but still good, documentation:

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/476781/ipv4-pools

 

Terms & ConditionsAccessibility statement