How to configure a group of 8 IP

Forum|Forum|4 years ago
March 2, 2022
3 replies
2026 views

Good afternoon community.

My case is the following, I hired a block of 8 public IP's with my ISP and I have not been able to configure it properly in my FT100e.

MY ISP gives me the service through an ONT which I connect to my WAN1 in PPPoE mode and assigns a local IP of the ONT to WAN1.
Configure a VLAN subinterface on my WAN1 where I configure the first usable IP of the /28 block, the others I place as secondary.
Create a static route pointing to the GW that is assigned to WAN1 dynamically.
Create a policy to allow LAN=>WAN1 access

Under this scenario, the LAN network on my port 1 navigates without problems, but the FG100e does not ping the Internet nor can I reach the IPs of the block externally.

Any help or suggestion would be greatly appreciated.

Greetings.

FortiGate

Best answer by apinales

Hi @Toshi_Esumi. I thank you very much for the answer.

I talked to my ISP about the recommendation you gave me but it didn't work. They recommended another scenario, which I was able to implement and everything works for me without any problem.

Configure Interfaces:
ONT => WAN1 via PPPoE. The static route assumes itself, there is no need to create it.
LAN Port 1: My internal LAN network
LAN Port 2: here I configure the first usable public IP of the range that the ISP gave me, and the other IPs as secondary. Note: This interface does not necessarily have to have a cable connected to it.

Policies:
LAN Port1=>WAN1, with NAT, use IP Pool that contains the range of public IPs in Overload mode. (to browse from the internal LAN)
LAN Port2=>WAN1, no NAT (to browse directly from IP range)
WAN1=>LAN Port2, no NAT (for external management)

Toshi_Esumi

SuperUser

If ISP's hand-off at the ONT is VLAN tagged all PPPoE packets should be VLAN tagged too. And you need to configure everything on the VLAN subinterface.
At least in our area of the US, all Lumen/CenturyLink Fiber circuits are tagged with VLAN 201 for both residential and business. I configured PPPoE on the VLAN interface to terminate it at my/our FGT.
If you sniff on WAN1 and your VLAN interfaces, you can see which is carrying the actual L2/L3 traffic.

Toshi

apinalesAuthorAnswer

New Member

Hi @Toshi_Esumi. I thank you very much for the answer.

I talked to my ISP about the recommendation you gave me but it didn't work. They recommended another scenario, which I was able to implement and everything works for me without any problem.

Configure Interfaces:
ONT => WAN1 via PPPoE. The static route assumes itself, there is no need to create it.
LAN Port 1: My internal LAN network
LAN Port 2: here I configure the first usable public IP of the range that the ISP gave me, and the other IPs as secondary. Note: This interface does not necessarily have to have a cable connected to it.

Policies:
LAN Port1=>WAN1, with NAT, use IP Pool that contains the range of public IPs in Overload mode. (to browse from the internal LAN)
LAN Port2=>WAN1, no NAT (to browse directly from IP range)
WAN1=>LAN Port2, no NAT (for external management)

Toshi_Esumi

SuperUser

Ok, your ISP connection is not VLAN tagged then. I misunderstood your description of the circuit.

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded