Skip to main content
filu
filu
New Member
July 15, 2019
Question

Problem with External IP on second FG.

  • July 15, 2019
  • 1 reply
  • 5137 views

Hello, 

In my network I have FortiGate 100D. In WAN1 i have addres xxx.xxx.xx.101/29. Now I want to install a Fortigate 30e for one of segments my network so I need to configure one of adresses frome class xxx.xxx.xx.101/29 as WAN1 on Fortigate30E. How should I confgure Interfeaces on FG100 and FG30? 

 

In other network where I have to IP classes on WAN interfaces so I can adreess WAN 2 in FG100 and WAN1 on FG30 to diffrent addreses. 

 

In this case when I try address a WAN2 i have conflict with subnet on WAN1. 

 

So i new configuration I will have ISP WAN -> FortiiGate 100D -> FortiGate30D 

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    July 15, 2019

    hi,

    and welcome to the forums.

     

    Create a VIP on the 100D for a second public IP (not used on the 100D's WAN interface), and as the 'mapped-to' address you fill in the (private) WAN address of the 30E. You can put the 30E on your LAN, or create a small transfer subnet between an unused port of the 100D and the WAN port of the 30E.

    The VIP will even act as a source NAT for traffic coming from the 30E, no need to worry about that.

     

    To make the VIP effective, you need to use it in a policy on the 100D:

    src intf: WAN

    dst intf: LAN (for example, the port the 30E is connected to)

    src addr: ALL

    dst addr: my_VIP (!)

    no port forwarding

    service: ALL

    no NAT

    filu
    filuAuthor
    New Member
    July 15, 2019

    Thank you for replay. 

    So I should set private ip on un used port on FG 100 for x 10.100.0.1 and 10.100.0.2 for WAN1 on FG 30? 

     

    If i don't have a external IP configured on this F30 may I configure a VPN conection  Site to Site between two FG's ? 

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    July 15, 2019

    Your suggestion for IPs is correct.

     

    EVERYTHING is a bit more difficult if the FGT doesn't face the internet directly. Either try it out, or put the VPN on the 100D. It's more powerful anyway.

    Terms & ConditionsAccessibility statement