New Member

Question

Need to configure WAN side LAN IPs under firewall

17 replies
1530 views

I asked for an extra IP from the ISP. For that they had given me /29 IP block.

They said that they will work under the old pilot IP which was already given by ISP.

That IP was configured WAN1 and internet are working well. But I need to use that additional IP under firewall.

Because i am going to host one web application server. For that server i need to configure public IP directly.

If it comes under the server means i can able manage and control who are all want access the app server.

I am using FG101E.

FortiGate

fricci_FTNT

Staff

Hello @spmbalamurugan ,
If my understanding is correct, your ISP has provided you a /29 subnet that you can use for your internal servers. If that is the case, you can configure a VIP on your FortiGate that will forward traffic from that VIP to your web application server. You can then configure proper firewall policies for the web application access.
You may find the below article useful:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143

Best regards

dingjerry_FTNT

Staff

Hi @spmbalamurugan ,

If you can use one WAN interface only, you may configure the second /29 IP block to your current WAN interface as the secondary IP.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Set-a-secondary-IP-on-a-FortiGate-interface/ta-p/226046

Toshi_Esumi

SuperUser

It's common way for an ISP provide additional IPs (a block of IPs) over the interface subnet (/30 ro /31). Packets destined to those totally 8 IPs (full /29 subnet IPs) would be delivered to your wan interface IP so that you can either route them through a LAN side interface or map them to private/internal IPs by VIPs.
If you want the server to have one of /29 IPs without a VIP, you can assign one of the /29 IPs on the FGT LAN interface (or a VLAN interface) and make it the server's GW IP. That's the traditional way to do "routing" the public IPs when an L3 router without VIP capability terminates the ISP interface.

Toshi

M

miromaro

New Member

I have now similar situation:
on WAN interface I have public IP with 248 netmask and it’s ok.
I have second public subnet with 240 netmask.

I want to put this second subnet IPs for servers but without VIP is it possible like you write?

I tried in DMZ but it isn’t working, it must be only in transparent mode?

Those two subnets are from the same ISP.

Many thanks for any help :)

funkylicious

SuperUser

if you want to use the new public subnet as directly configured IP’s and not VIPs, you can do that in 2 ways:

- as a secondary IPs on an existing WAN interface, where the interface will be the gateway for that subnet and the hosts which will be assigned IPs from this subnet need to be in the same VLAN as the WAN interface + firewall rules accordingly

- configured a new interface and put in a different VLAN which will act as a gateway + firewall rules

also, the new subnet need to the routed by your ISP to the existing subnet/WAN

"jack of all trades, master of none"

M

miromaro

New Member

Once again thanks, sorry for my late reply, I was on vacation :)

When I started to fight with this problem I’ve found this diagram

And this is how I wanted to work, but I think this scenario is only possible in transparent mode of forti.

My forti is working in NAT and of course I can’t change it.

What do you mean that device must be in the same vlan as ISP router? - this could be only possible if I put switch between forti and ISP, right?

My physical connection is the same just like in the picture: I have two subnets on WAN and I want external IP on the port of forti, whatever which one.

funkylicious

SuperUser

yes, adding a switch between ISP and FortiGate WAN would help, all the devices would be in the same VLAN/segment

connecting other devices to another port on the FortiGate would break this segment when running in NAT.

you could create a software switch where you add the WAN and DMZ, in your case, which will create a ‘switch’ but will requre reconfiguration of the rules/objects/routes and others bound to the WAN so a real switch between ISP and FGT would be the way to go.

"jack of all trades, master of none"