Skip to main content
dblackwell
dblackwell
New Member
November 15, 2018
Question

Virtual IP Confusion

  • November 15, 2018
  • 3 replies
  • 4028 views

I need help understanding this concept. Let's say my logical WAN address is 1.1.1.1 and I have a VIP of 1.1.1.2 assigned to a internal mail server. does the VIP address need to be assigned by my ISP? I just don't understand how I can use another outward facing address when my ISP is only giving me 1.1.1.1. Is this all done with NAT? So if it is just that (a virtual IP run over the physical 1.1.1.1 interface) then what is the point of doing this? Can I use any VIP I want? As you can see I quiet confused about this. The above is how my current exchange server is setup through a FortiGate 60D firewall and was when I took over for the company I work at.

    3 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    November 15, 2018

    In your example, both 1.1.1.1 and 1.1.1.2 need to be routable on the internet. Otherwise SMTP servers in the world can't send email to your email server with 1.1.1.2. If you don't have own ASN and advertise your subnet(s) over BGP to your ISP, additional IPs need to come from your ISP.

    Then you can create an IP-pool with 1.1.1.2 and use it with your email server's outgoing policy to do SNAT. This part is described in below article (GUI method only though):

    https://www.mirazon.com/h...ip-pools-in-fortigate/

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    November 17, 2018

    First, ping both 1.1.1.1 and 1.1.1.2 (the real IPs, I mean). If both are pingable you have proof that your ISP routes a subnet to your router and not a single address only.

    It could be 1.1.1.1/29 for 6 public addresses, /30 is just enough for 2 addresses (the FGT and the ISP gateway).

     

    After clarifying this we can look further how to make more than one internal server accessible from the 'net.

    siomyn
    siomyn
    New Member
    November 19, 2018

    Like ede_pfau said, we need to check the subnet IP that ISP give. If the ISP give you /30 (255.255.255.252), you just have 1 IP address assigned to your fortigate (another IP would be your gateway). If you need create VIP, you should use port-forwarding instead 1-to-1 nat.

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!