ISP Secondary IP address

Forum|Forum|2 years ago
November 16, 2023
7 replies
4521 views

Dear support,

I'm seeking guidance regarding my current network setup and the configuration required to enable internet access using the ISP-provided LAN IP pool (1.1.2.2/29 subnet) via our Fortinet firewall.

Currently, our Fortinet firewall's WAN interface is configured with the WAN IP pool address (1.1.1.1/30), and it's functioning seamlessly. However, we now aim to utilize the ISP-provided LAN IP pool (1.1.2.2/29) to enable internet connectivity using IP addresses within this subnet.

Any detailed instructions or guidelines you could provide regarding these configurations would be immensely helpful in achieving this setup.

FortiGate

Best answer by Toshi_Esumi

First, the additional /29 subnet should be described as 1.1.2.0/29 then 1.1.2.2 is just one of IPs in it.

Two more ways to utilize the additional /29 subnet in addition to SNAT with ippool @adimailig explained.

2) use them for DNAT/VIP to map those individual IPs to internal servers like a web server, FTP server, etc. to let outside parties to access those servers.

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/728694/destination-nat

3) lastly, your ISP's assuming usage for the subnet as a "LAN" subnet is to use the /29 on one of LAN interfaces on the FGT(router). Nothing different from the default 192.168.1.0/24. Just pick one IP from /29 like 1.1.2.1 and configure it on the LAN interface, then use the rest 1.1.2.2 - 1.1.2.6 for the LAN devices. Their GW is of course 1.1.2.1.
Only difference for this is the policy(ies) for this LAN interface to the internet should have NAT/SNAT disabled. This is the traditional way of using an additional subnet with a simple L3 router from the beginning of the internet.

The ippool SNAT option and DNAT option can be combined if you want or need, and you can utilize all 8 IPs, 1.1.2.0 - 1.1.2.7. With the last routing option, the usable IP is only 1.1.2.1 - 1.1.2.6 while 1.1.2.0 is subnet address and 1.1.2.7 is broadcast address.

Toshi

adimailig

Staff & Editor

@prince
You may utilize/configure IP Pool (1.1.2.2/29) and use it on your firewall policy.
What will happen is Source IP will be translated to one of the IP from IP Pool.

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/29961/dynamic-snat

Note that ISP should have route on their network going to 1.1.2.2/29.

princeAuthor

New Member

ISP has provided Wan IP pool address in 1.1.1.1/30 subnet and ISP lan pool address is in 1.1.2.2/29 subnet. both the IP address are in different subnet.

adimailig

Staff & Editor

That is fine as long as the ISP has route set on ISP network for 1.1.2.2/29 pointing to your network at 1.1.1.1/30.
For example:

IP POOL (1.1.2.2/29) >> FGT <1.1.1.1/30> ---- <1.1.1.2/30> ISP Router ---- Internet
* ISP Router have static route 1.1.2.2/29 gateway 1.1.1.1

On the fortigate we will use IP Pool. It means that outgoing traffic will be having source IP 1.1.2.2 when it hit the ISP Router. Traffic will be accepted by ISP Router and forwarded to internet.
Return traffic will hit ISP Router and since it knows how to get to 1.1.2.2 ISP Router will forward return traffic to FGT 1.1.1.1.

Toshi_EsumiAnswer

SuperUser

First, the additional /29 subnet should be described as 1.1.2.0/29 then 1.1.2.2 is just one of IPs in it.

Two more ways to utilize the additional /29 subnet in addition to SNAT with ippool @adimailig explained.

2) use them for DNAT/VIP to map those individual IPs to internal servers like a web server, FTP server, etc. to let outside parties to access those servers.

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/728694/destination-nat

3) lastly, your ISP's assuming usage for the subnet as a "LAN" subnet is to use the /29 on one of LAN interfaces on the FGT(router). Nothing different from the default 192.168.1.0/24. Just pick one IP from /29 like 1.1.2.1 and configure it on the LAN interface, then use the rest 1.1.2.2 - 1.1.2.6 for the LAN devices. Their GW is of course 1.1.2.1.
Only difference for this is the policy(ies) for this LAN interface to the internet should have NAT/SNAT disabled. This is the traditional way of using an additional subnet with a simple L3 router from the beginning of the internet.

The ippool SNAT option and DNAT option can be combined if you want or need, and you can utilize all 8 IPs, 1.1.2.0 - 1.1.2.7. With the last routing option, the usable IP is only 1.1.2.1 - 1.1.2.6 while 1.1.2.0 is subnet address and 1.1.2.7 is broadcast address.

Toshi