2 WAN interfaces in same subnet?

[#1]

I' m trying to set up a FortiGate 60 with both WAN ports in a official /29 net. I have upgraded it to 3.00 and successfully set addresses and policies on all interfaces. I get stuck on the external routing/gateway. Tried both static routes and policy routes without success, but can' t get both interfaces to work at the same time. The idea is to have " DMZ" use one WAN and " Internal" the other WAN port. Any hints? Is this possible?

[#2]

Alctually this should be possible. But: Why the hell do you want some configuration like that? Keeping this apart means a lot of work with policy based routing.... (since we do not have virtual routers - grrrrr.) Why don' t you define NAT/Port forwarding as you like it ... or use some differnet device for routing and use the FG in transparent mode? In my personal opinion Fortinet did not invent routing.... Firewalling/Tunneling/ContentFilter etc. is not bad but routing is really *normal* with no special features.

[wcbenyip]

I do agree that FG did not provide a good routing functionality~ But I still thinking that it' s not a bad idea to have two WAN link, in my case, one for VPN tunnel connectivity, another one for normal Internet access~ Keihin: what' s your type of Internet connections? ADSL or with fixed IP? I also found that the fg60 seems so strange when connected to the ADSL (without fixed IP)... the default route seems useless.... even you set the default gw as whatever, the internal hosts still can connecting to the Internet..... up to this moment, I still cannot make the 60 working properly with the 2 WAN link on WAN1 & WAN2.....

[#4]

Thanks for reply. I have good reasons to use 2 different IP addresses, and this _should_ work. I have 2 FG60, and have now put them both in parallel using only wan1 on both with adjacent IPs. Works like a charm. First time ever I can ping both external IPs from outside... I now struggle with another problem: accessing my own external IP from inside my office. I' m testing some Internet clients, and need my official IP to work also in the office. All Internet access works fine, but I can' t ping nor access my external IPs from my LAN (internal). I only have a ALL->ALL with NAT checked in my Internal->WAN1 part of the firewall. Any ideas?

[#5]

diag sniffer packet wan1 " icmp" This will tell you if the traffic is reaching the nic or not. You can also put a sniffer on your internal interface as well. This will tell you where the traffic is getting too. You can also try doing a traceroute and make sure that your traffic is not going out and reaching the destination, but trying to return to you another way.

[#6]

K, What you wish to do will take some creative configurations, but in the subnet mask you describe, it cannot work. Routed traffic must traverse between dissimilar subnets, otherwise you face a subnet overlap. What you might try is supernetting (resubnet) your subnet. Instead of using /29, use a /32 subnet on each, and use the same gateway IP in your static routing table. The 255 subnet causes for the net ID, host ID, and the broadcast ID to be all the same IP; just like the old-fashioned dial-up connections provided. If it works, great. If not, well, sorry but I don' t think it can with similar /29 IPs, unless you connect the router to a layer-2 or layer-3 switch.

[#7]

Thanks for input. You say it can' t be done, theoretically? But how do you explain that it works when I use 2 FortiGate devices? The latest problem I had was solved when I found that a downed interface isn' t actually downed (bug). I had to change the IP' s on the downed interfaces on both boxes, and suddenly everything worked fine. I' ve also set up this configuration using Linux without problems.

[#8]

Hello All, In general, a router is routing between different IP networks and will not allow to have multiple interfaces in the same subnet. It' s like a crossing, there are not two ways going right, only one :-) From routing (layer 3) perspective if there are two local IP connections going to the same subnet the router cannot decide on which to use. I assume when you use two F60' s you have the routing process running on both of them? So on every box a routing decission is made by a separate process resulting in no issue for every box having one interface to the same subnet. My 2 cents. Jan

[#9]

i think your refering to NAT loopback

[#10]

Darn it, I wish I would have thought of that.