Please review new network scenario with /30 subnet between WAN intf and ISP router

4 replies
6267 views

Hi

Hope somebody could review this scenario and come up with some hints.

I have Fortigate 300D as a typical perimeter firewall. On external interface (WAN) I have larger public IP subnet of size /26. WAN interface terminates several IPSec site2site tunnels, most part of internal traffic is NAT'ed (overload) to that interface's IP, all server NATings or port forwardings are defined as VIP where public IP is from that /26 public subnet. Some of servers use IP_Pool option in order du source NAT exactly to wanted static public IP.

But now, my ISP wants to use a transport net (/30 subnet) between my WAN interface and their CPE router. So I will get a new public /30 subnet on WAN interface, and I am wondering where do I move my /26 public subnet? Do I need to configure it on some other interface or should I define it on a new loopback interface? What happens to site2site VPN traffic then? I haven't find any guide for this kind of scenario.

Ideas and hints are highly appreciated!

BR Zoran

WAN

Toshi_Esumi

SuperUser

I haven't done but likely moving the /26 to secondary IP/subnet on the WAN interface would work without any other changes. Somebody else, please correct me if I'm wrong.

zorroAuthor

New Member

Thanks for great the idea, Toshi!

I think that solves my concerns about terminating IPSec VPN tunnels as well. Fortinet says clearly in doc that VPN can be terminated on secondary IP, but nothing about terminating VPN tunnel on another interface, not directly exposed to Internet.

BR Zorro

Toshi_Esumi

SuperUser

That part I can tell that it doesn't matter if it's on the outside interface or any other interface as long as the route is there so that the remote side can reach the IP/interface.

Sign up

Login with SSO

Login to the community

Login with SSO