Skip to main content
EricG1793
EricG1793
New Member
January 7, 2016
Solved

One WAN interface, multiple WAN IPs

  • January 7, 2016
  • 1 reply
  • 23417 views

Hi folks,

We're using the WAN1 interface on our FortiGate only, with IP 72.x.x.1. The internal subnets 10.x.x.x all go through this interface and IP.

 

However, I've set up a new subnet on interface Dorm1, 192.168.1.x, and I want it to utilize a different WAN IP, 72.x.x.6 (which is in the same subnet as the primary WAN1 IP with the same ISP gateway). How can I accomplish this? I've read about creating VIPs, which we do use to map one external IP to one internal IP, but I'm not sure how to handle an entire subnet, AND ensuring that the outgoing traffic is through the other WAN IP as well.

 

Thanks for any ideas,

 

- Eric

    Best answer by ede_pfau

    You are planning to NAT 2.046 addresses, or is there a typo in your address ranges?

    If the mapped-to address is just one, each translation has to be mapped to a different port. There are 64K - 1K ports for this but...this number might be limited by the hardware/FortiOS combination. Have a look at the "Maximum Features matrix" available on docs.fortinet.com .

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    January 7, 2016

    Hi,

     

    for outward traffic you would substitute the source address, not the destination address like in a VIP. Source NAT is done via "IP pool" (Firewall > Objects > IP pools). You can define an IP pool with just a single address (a.b.c.d/32) or a whole subnet.

    In the LAN to WAN policy, check "NAT" and "specify address" and select the IP pool.

    Check with a visit to whatsmyip.org or the like.

    EricG1793
    EricG1793Author
    New Member
    January 8, 2016

    Perfect, that worked! Thanks for the info. :)

     

    One more question. I went to do the same for a different VLAN on the Inside interface. External IP is 72.x.x.13-72.x.x.13 and the internal IP range is 10.13.0.1-10.13.7.254. However, it says the number of ports for each IP is too small. It works if I shrink the internal range to 10.13.6.254. Thoughts?

    ede_pfau
    SuperUser
    ede_pfauAnswer
    SuperUser
    January 8, 2016

    You are planning to NAT 2.046 addresses, or is there a typo in your address ranges?

    If the mapped-to address is just one, each translation has to be mapped to a different port. There are 64K - 1K ports for this but...this number might be limited by the hardware/FortiOS combination. Have a look at the "Maximum Features matrix" available on docs.fortinet.com .

    Terms & ConditionsAccessibility statement