Skip to main content
Mark239
Mark239
New Member
November 10, 2014
Question

Unnumbered IP against WAN interface

  • November 10, 2014
  • 9 replies
  • 42557 views

Hi

 

Has anyone ever got this to work?

 

British Telecom (for example) offer a static IP service which works by assigning a dynamic link address to the PPP endpoint (The firewall in this case) and then the exchange equipment routes the blocks of static IP addresses to this device based on their dynamic link address.

 

On a cisco device, all you have to do is unnumber one of these static addresses against the dialer interface and you can assign a static to the firewall/appliance. 

 

This never seems to work in FortiOS - the system seems to ignore the unnumbered address, amd I always have to use DDNS to enable the use of SSL VPN etc. Is this expected behaviour ?

    9 replies

    emnoc
    emnoc
    New Member
    November 10, 2014

    If this is PPPoE,  than yes the fortigate can work with most carriers. During  the ppp and during the ipcp portion, it will negotiate the address with the ppp-server.

     

     

    Mark239
    Mark239Author
    New Member
    November 10, 2014

    Hi

     

    I'm aware of that, I've set it up in this manner many times.

     

    My point is - the unnumbered IP, if set under the WAN interface, is always ignored by the system.

     

    It works on any cisco device when unnumbered against the dialer interface, but not on the fortinet.

    Mark239
    Mark239Author
    New Member
    November 10, 2014

    I want to recreate this: (Vlan 1 has one of the assigned statics)

     

    interface Dialer1  ip unnumbered vlan1  encapsulation ppp  dialer pool 1  dialer-group 1  ppp authentication chap pap callin  ppp chap hostname BROADBAND USERNAME  ppp chap password BROADBAND PASSWORD  ppp pap sent-username BROADBAND USERNAMEm password BROADBAND PASSWORD

    emnoc
    emnoc
    New Member
    November 10, 2014

    Not sure what you men ignored, but did you remove all policies or other bindings under wan1?  PPPoE is straight forward but if you re reconfiguration from a mode other-than pppoe, than  you need to police any dependencies checks.

     

     

     

    Paul_Dean
    Paul_Dean
    Visitor III
    November 10, 2014

    I worked around this by selecting one of the IPs in the subnet as a management IP and creating VIPs from the wan1 interface to another FortiGate interface.

     

    That way I don't care if the dynamic wan1 address changes as the requests are always routed to the management IP.

     

    I'm not sure why BT do it this way. Other ISPs we use either assign a static IP or bridge the subnet on both sides of the router.

    norouzi
    norouzi
    New Member
    November 10, 2014

    Dear Mark

    If you have public static IP address and you configure FortiGate in PPPoE mode, Then your device is accessible from the internet directly.

    So you can implement VPN SSL. Why you need to configure DDNS if IP address is static?

     

    Mark239
    Mark239Author
    New Member
    November 10, 2014
    That's not how it works when you buy a block of ips from the likes of British telecom. They route the static addresses to the dynamic link address that is assigned every time the device reboots.
    emnoc
    emnoc
    New Member
    November 10, 2014

    Will I know the question is not to me, but that's exactly what I do. Configured dyndns and then i can care less if the  ISP  give me a new address.

     

    norouzi
    norouzi
    New Member
    November 10, 2014

    Mark, You mean that in this case your Virtual IP addresses can not work? Did you check it?

    or maybe you want to uses public IP addresses in local network?

    JJ1
    JJ1
    New Member
    February 2, 2016

    I believe what you are looking for is this:

     

    http://www.mylesgray.com/networks/fortigate-unnumbered-ip-against-pppoe-interface/

     

    Basically you have to tell the FGT to not negotiate the unumbered IP with the provider so it forces to the static IP (from your assigned subnet) which you set on the interface:

    set pppoe-unnumbered-negotiate disable

    echo
    echo
    Explorer II
    August 12, 2016

    I am debugging why Mexico Uninet pppoe does not connect on FGT50E cluster with FortiOS 5.4.1. I found that this command described here is not available there. Although this was included in CLI reference for 5.4. The interface that I try to configure is actually a vlan interface. I still don't know if this is the same issue which is described here or something else... But even if the above command helps certain people, does this continue to be so with FortiOS 5.4?

    natshawnz
    natshawnz
    Visitor III
    January 22, 2023

    Have you tried disabling pppoe-unnumbered-negotiate?

    Terms & ConditionsAccessibility statement