2 Public IP from same ISP for Two Departments on Same FortiGate

[robert_espi]

Hi,

I got a block of public ips with 2 usable ips. I wanted to add the first ip out of the block for department A on wan1 port. And the second ip on wan2 for department B. I have no trouble adding the first ip for department A. When I'm adding the second ip for department B i get an error stating "conflicts with wan1 subnet'. 

Department A -> Wan1

= IP- 200.200.20.2 Subnet mask 255.255.255.248 Gateway is 200.200.20.1

Department B -> Wan2

= IP- 200.200.20.3 Subnet mask 255.255.255.248 Gateway is 200.200.20.1

I understand the conflict, but is there another way of achieving this? I know you can add a secondary ip when configuring an interface. Perhaps this is what i need to do and just use an ip pool for outgoing interface for traffic from department B to pass thru 200.200.20.3. 

[abhamit533]

I got a block of public ips with 2 usable ips. I wanted to add the first ip out of the block for department A on wan1 port. And the second ip on wan2 for department B. I have no trouble adding the first ip for department A. When I'm adding the second ip for department B i get an error stating "conflicts with wan1 subnet'. 

[Peter-Wainwright]

Having two interfaces in same IP range in same VRF/VDOM will not work out well for you, and I would strongly recommend investigating the use of VDOMs.

By using VDOMs and "EMAC VLAN" interfaces, you can configure multiple VDOMs to "share" a single wan/aggregation/redundant/etc interface. For example, you have a single connection from your ISP with a /28 public allocation (A.B.C.0/28):

• A.B.C.1 is the ISP router.
• "DEPT-A" VDOM uses A.B.C.2/28 on wan interface.
• "DEPT-B" VDOM uses A.B.C.3/28 on EMAC-VLAN interface created on wan interface.
• "DEPT-C" VDOM uses A.B.C.4/28 on EMAC-VLAN interface created on wan interface.
• "DEPT-D" VDOM uses A.B.C.5/28 on EMAC-VLAN interface created on wan interface.

I've used this method numerous times since it was introduced in FortiOS 6.0 (?) and it works very well.

Regards,

Pete