Multiple Subnets on a Single External Interface

Question

Hey everyone,

I have what I consider a little bit of an odd routing situation and I am not sure if the Fortigate's support it and how you do it. I haven't found it in the manual yet. I have personally never run into it before but I can't believe it is uncommon today.

So here is the situation:

[ul]

We currently run 200D Fortigates on 6.0.X.

At one of my locations I have a /29 on a WAN interface from our ISP.[ul]

I need to add additional IPs and we would like to do it by adding another /29. (I don't even know what you call this technically.) This amounts to supporting two subnets on the same external/WAN interface. This is something I have never done before but I am aware it can be done on other hardware.[/ul]

I saw some information for 4.x that appears to be relevant to internal routing but not from the outside in.[/ul]

Our options are Two /29s as described above or move to a new /28 and change everything that is on the existing /29. I would rather avoid moving to the /28 as it means outages and such. I don't see us needing more IPs for a while so another /29 would be more than sufficient.

Thanks in advance for any help you might be able to provide!

Toshi_Esumi · Accepted Answer

Or, nothing additional config on the wan interface unless there are multiple devices hanging off of the ISP circuit and they share the /29 subnet with the FGT.

In many cases an ISP assigns a /30 for the interface (GW IP on their end) and route an additional /29 routable subnet to the main Interface IP as the customer's network needs grow. So the /29 can be used on the LAN side, or you can of course use each IP with VIPs on the FGT. This is a very common way with a L3 router.

So it's depending on your network requirement and the reason you got the /29 new subnet.

ede_pfau · Answer

hi,

and welcome to the forums.

I think you can solve this easily, by creating a secondary address a.b.c.d/29 on the WAN port. Your ISP will route this subnet to your primary WAN address so that routing is no issue.

There are subtle differences between primary and secondary addresses, mostly when it comes to services you offer on the WAN port.

For instance, IPsec VPN and SSL VPN per default listen on the primary WAN address - not on the whole subnet, nor on any secondary addresses. Fortunately, you can twist the config accordingly if you wish to use a secondary address for these services.

Depending on your use case, you could even emply Virtual Addresses (VIPs) instead of "physical". Nowadays they even respond to ARP if configured. On egress traffic, they will automatically source-NAT outbound traffic (what a misuse of language...).

IMHO, real secondary addresses are easier to use, are visible in GUI (this has not always been the case) and the concept is well known.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded