Unable to Correctly Set WAN Port on Fortigate 600D

Question

We are implementing a Fortinet infrastructure into one of our main buildings. We are essentially building a new network for these users and we are looking for this system to mesh well with our existing devices. I am currently setting up a Fortigate 600D running v5.4.4.

I am trying to set up the WAN port on the Fortigate but every IP I assign to the port is erroring out, claiming that it belongs to our main firewall. The goal is to have a PAT so one external IP address (that belongs to our organization) should do it. At first we were trying to chase down ARP tables from different devices to figure out why that specific IP might be claimed, but as I started to toy around I noticed that even private IPs, externals that didn't belong to us, and IPs I was making up on the spot were claiming to be taken by our main firewall. Is this a bug with the Fortigate Software?

As a work around, I was able to set the WAN IP to 0.0.0.0/0.0.0.0, disable the port, set the IP correctly to one of our globals, then enable the port but it's triggering all sorts of ARP flaps on multiple devices now, so I'd like to avoid that route. Any suggestions?

ede_pfau · Accepted Answer

I know what Bob is suggesting. My feeling is that it won't help, and no, this is not common practice.

There are 3 ways to associate an address with an interface:

- define it as primary address (GUI/CLI)

- define it as secondary (tertiary,...) address (secondary in GUI, others in CLI)

- define a VIP (virtual IP) associated with this interface

All of which would work even as a single measure (ie., a VIP would even work if there is no interface address at all).

But the common way is to define a primary IP on the WAN interface. Throwing an error message could be a bug but could as well be rightful.

One thing to keep in mind is that the FGT is a router. No 2 interfaces may use addresses from the same collision domain. You can check address overlap for instance by looking at the routing table (Routing > Monitor).

Lately, I've had serious trouble with the GUI blocking an address setting because "address overlap with management port setting". Management ports have the special quality that they explicitely allow an address from a otherwise configured subnet, for instance the LAN port.

It turned out the the new "role" parameter in the GUI/CLI caused this. Setting the address in CLI always worked, and setting the role to "undefined" let me set the address in the GUI as well. You might check this.

If you still have problems then please provide more info on the address spaces used: which addresses are assigned to the ports, which netmasks are used (check them!). I guess you use a transfer net between the HQ FGT (WAN port) and the branch FGT.

rwpatterson · Answer

Welcome to the forums. What is your goal here? If you simply want outside traffic to see you as an IP address, create an IP pool with that single address and use it inside of the outgoing policies.

Sign up

Login with SSO

Login to the community

Login with SSO