Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
robert_espi
New Contributor II

2 Public IP from same ISP for Two Departments on Same FortiGate

Hi,

 

I got a block of public ips with 2 usable ips. I wanted to add the first ip out of the block for department A on wan1 port. And the second ip on wan2 for department B. I have no trouble adding the first ip for department A. When I'm adding the second ip for department B i get an error stating "conflicts with wan1 subnet'. 

Department A -> Wan1

= IP- 200.200.20.2 Subnet mask 255.255.255.248 Gateway is 200.200.20.1

 

Department B -> Wan2

= IP- 200.200.20.3 Subnet mask 255.255.255.248 Gateway is 200.200.20.1

 

I understand the conflict, but is there another way of achieving this? I know you can add a secondary ip when configuring an interface. Perhaps this is what i need to do and just use an ip pool for outgoing interface for traffic from department B to pass thru 200.200.20.3. 


 

R.E
R.E
11 REPLIES 11
abhamit533
New Contributor

I got a block of public ips with 2 usable ips. I wanted to add the first ip out of the block for department A on wan1 port. And the second ip on wan2 for department B. I have no trouble adding the first ip for department A. When I'm adding the second ip for department B i get an error stating "conflicts with wan1 subnet'. 

Peter-Wainwright
New Contributor II

Having two interfaces in same IP range in same VRF/VDOM will not work out well for you, and I would strongly recommend investigating the use of VDOMs.

 

By using VDOMs and "EMAC VLAN" interfaces, you can configure multiple VDOMs to "share" a single wan/aggregation/redundant/etc interface. For example, you have a single connection from your ISP with a /28 public allocation (A.B.C.0/28):

  • A.B.C.1 is the ISP router.
  • "DEPT-A" VDOM uses A.B.C.2/28 on wan interface.
  • "DEPT-B" VDOM uses A.B.C.3/28 on EMAC-VLAN interface created on wan interface.
  • "DEPT-C" VDOM uses A.B.C.4/28 on EMAC-VLAN interface created on wan interface.
  • "DEPT-D" VDOM uses A.B.C.5/28 on EMAC-VLAN interface created on wan interface.

I've used this method numerous times since it was introduced in FortiOS 6.0 (?) and it works very well.

 

Regards,

 

Pete

NSE 7
NSE 7
Top Kudoed Authors