Skip to main content
DamianM
DamianM
New Member
September 7, 2020
Question

Multiple public IP on one wan port (2 networks)

  • September 7, 2020
  • 2 replies
  • 19474 views

Hi all, I have problem with configuration multiple public IP on one Wan port. Our provaider set as one public adres on 176.x.x.x.x/30 and then set 8 addicional public IP adresses on 89.x.x.x/29 (4 to use). Everythink is agregated on one wan port. I would like to use one of 89.x.x.x adresses to use it for our webserver.

Interface on our Fortigate is configured on 176.x.x.x network. How can I use addicional IP's?

In "IP Pools" there is no options to set gateway or mask for 89.x.x.x network. How to set this?

 

    2 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    September 7, 2020

    A common way to provide additional public subnets by ISPs. You seem to have decided to do mappings from those public IPs to servers' private IPs, instead of routing by assigning it on a LAN interface. Then  you need to configure VIPs for inbound (DNAT) and use ippools (SNAT) for oubound to/from those servers. There are many articles in Doc libraries or on the internet for these. I listed a few below.

    https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/510402/static-virtual-ips

    http://itadminguide.com/one-one-static-nat-configuration-fortigate/

    By the way, if you get a /29 additional subnet and use all of them as VIPs/SNATs, you should be able to use all 8 IPs. If you decided to just route them to LAN side (means servers have public IPs) the FGT takes one IP (ex. .1) and the rest, 5 IPs (ex. .2 - .6), should be usable for servers except the subnet (ex. .0) and broadcast (ex. .7) addresses.

    sw2090
    SuperUser
    sw2090
    SuperUser
    September 8, 2020

    You cannt use all 8 IPs in a /29 because the 1st ist the network address and the last is the broadcast address. So it is 6 usable addresses in /29.

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    September 8, 2020

    Yes, you can if you use VIP/SNAT in most cases as I stated. You, of course, can't use sbnet/broadcast address if your "route" the subnet.

    maick78
    maick78
    New Member
    September 12, 2020

    Hi DamianM,

     

    I recommend you configure Vlans for each network (2 VLANs). So you add them to the port and also to the SD-WAN, in the SDWAN configuration you can put the gw of those networks.

    Also remember that you can implement it in a LACP.

     

    S2s

    Terms & ConditionsAccessibility statement