New IP Public Range on same WAN interface

Not sure if it is the same on Fortigate_VM, but on the hardware boxes you can configure a "secundary ip" address on the interface.

Go to "Network > Interfaces" and edit the interface, at the bottom of the page you should have a check box "secundary ip address" if the interface has a manually assigned ip address. In the box that appears, type in the new ip address for your FGT, only 1 address is necessary..

Hi Johan,

I've already configured new IP as secondary address on wan interface.

Is necessary to configure static route? VIP?

What test can i do to verify this?

Thanks.

Regards

It depends on what you need to do:

- outbound connections will by default take the wan interface ip address for natting. If you need to access the internet with an address from the new ip range, you need to create a "ip pool" and use this pool as NAT ip on your internal -> outside security policies

- if you need inbound connections on the new ip pack, you need to configure vips for these addresses/ports and use them in outside -> internal policies.

If you need more info, just give me a sign.

Hi Johan,

let me configure server and policy for test, i will update you as soon as possible.

Thanks a lot.

Regards.

L.

No it normally isn't necessary, the ISP will use the original ip as path to the outside world as they will also have configured a 2ndary ip on their box. So you would use only the original default route that was already configured.

Having 2 default routes with the same metric would also put your FGT in "load balancing", sending packets out with source address 1.1.1.1 for 1 packet and 2.2.2.2 for the next. It would cause you troubles with outbound mail etc where the source ip is checked.

You would need to a a 2nd default route in case you have this setup:

FGT    <->      switch     <->     router isp1

                                   <->     router isp2

Hi Johan,

it doesn't work [&:].

Secondary IP on WAN interface-> Configured

IP Pool -> Configured

2nd default route-> (same distance, different priority)Configured

I'm in this scenario FGT    <->      switch     <->     router isp1 (first route Distance:10, Priority: 0)                                    <->     router isp2 (second route Distance:10, Priority: 10)

Policy Outside with NAT -> Configured

Can you help me?

Thanks

Leo

Nobody can help me?

Thanks.

L.

Hi Leo ,

We can add secondary ip address to an interface on fortigate , you can configure the new public ranges on the same wan 

interface ,these new subnets can be configured as part of secondary subnets. 

Hi! 

if ISP is the same and they take care of routing of the secondary /28 you can avoid to configure a secondary ip address on the wan interface. 

Simply configure VIPs and assign them to the ACL. 

I tried twice and it works fine!

ciao