Skip to main content
Umesh
Umesh
Explorer II
April 26, 2022
Question

WAN connectivity ( ISP1 & ISP2)

  • April 26, 2022
  • 4 replies
  • 3090 views

Hi Greetings to you all,

 

I need your comment for the below screenshot-

First I will explain that I have taken two ISP for internet connectivity in the organization -

both ISP have provided below IP pool-

Airtel - 1.1.1.0/30

           - 3.3.3.0/29

Voda - 2.2.2.0/30

          - 4.4.4.0/29

so which IP should I use for connecting both internet lines, as far as I think /30 for both internet lines and /29 used for servers. Is it correct what I am saying.

I have servers - Web server, Email server, DNS server, NTP server, etc.

Note - My question is why should we use separate  IPs for servers.

please explain if you understand from the below screenshot which I have prepared as per my understanding.

topology.JPG

4 replies

jintrah_FTNT
Staff
jintrah_FTNT
Staff
April 26, 2022

Hi Umesh,

 

Yes, your understanding on using /30 subnet for internet links and /29 for hosting servers is correct.

I believe you intend to use an IP address from each ISP pool to host a server for redundancy purpose, and that you do own a BGP AS number to host them on a single IP address to achieve redundancy when either of the internet links fail.

 

best regards,

Jin

 

Umesh
UmeshAuthor
Explorer II
April 26, 2022

Hi Jin,

I have one webserver just I want to know what would be configuration roadmap on the firewall with one public IP can you make me clarify it.

 

thank you

jintrah_FTNT
Staff
jintrah_FTNT
Staff
April 26, 2022

Hi Umesh,

 

Please see the article Technical Tip: Configuring Hairpin NAT (VIP) - Fortinet Community which would be helpful.

 

Best regards,

Jin

akristof
Staff
akristof
Staff
April 26, 2022

Hi,

Thank you for your question. You can use 1 real IP server and you create 2 VIPs, each for one public IP from one pool and you can DNAT traffic. Usually, each provider will give you different pools because they have different super nets assigned by IANA. And unless you have dynamic routing between both ISPs, ISP1 will advertise network 3.3.3.0/29 to internet while ISP2 will advertise 4.4.4.0/29 to internet.

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!