Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
srv4ever
New Contributor

3 ISPs with one public IP

My situation is this: I have 3 different ISPs: VIVO, TIM, and NET here in Brazil (1 Static IP and 2 Dynamic). I need to do 3 things:   1) Connect my 3 ISPs on one device.   2) I need to use only one public IP to connect to the internet. Every single workstation needs to connect through this IP as if there is only one ISP connected.   3) If the main link goes down, another link could assume its place but the same old public IP still must be used.  

Is there a way to do that? Any appliance, proxy, or DDNS?  

Thanks in advance.

   
4 Solutions
emnoc
Esteemed Contributor III

OP, why not engage SDWAN. Your 3x ISP is ideal for SDWAN. You set up 3x ports and cfg 3x subnets and set these are members in SDWAN

 

Ken Felix

 

PCNSE 

NSE 

StrongSwan  

View solution in original post

PCNSE NSE StrongSwan
sw2090
Honored Contributor

nope.

SDWAN enables you to use n WANs as one WAN for outgoing traffic.

If you want n WAN Lines with one IP you would need an aoutonomous subnet. Only those can be routed isp independent. But those are hard to get and expensive. And you need the neccessary technology to be able to announce routes...

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

View solution in original post

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
lobstercreed

As far as OP's question goes, this is of course impossible.  SD-WAN, zones, etc has no bearing. 

 

I keep seeing this question come up but it always has been and always will be impossible to use an IP that you don't own on a network that doesn't own that IP.  Routing 101...  It's like you moved to a different country but think that you can continue to use the old country's return address and your friends will somehow magically end up on your doorstep.

 

So the question for the OP is whether this "requirement" is truly a requirement or merely a preference?  If it's a true requirement, there is significant money and effort involved but clearly the bosses will pay if it's a requirement.

 

Otherwise, use SD-WAN like most folks and simply realize you may present the IP address of each of your WAN's depending on the route you take.  :)

View solution in original post

emnoc
Esteemed Contributor III

My thoughts ; unless he does BGP and have an allocation given, he is not going to use one single ip/subnet across 2 other ISPs. BCP38 egress filtering along will kill them. 

 

I would deploy SDWAN and if concern, set preference for ISP A over B or C  if required.

 

Ken Felix

 

PCNSE 

NSE 

StrongSwan  

View solution in original post

PCNSE NSE StrongSwan
14 REPLIES 14
Keeper_of_the_Keys

If you're willing to go the IPv6 route getting an AN may be easy...

srv4ever

Thank you all for your response, guys. You guys helped me clarify some concepts. We are probably going to get a VPN and send all traffic through it. The problem with outgoing with more than 1 IP is that we do use some banking applications, financial services that disconnect you when they recognize multiples IPs on a single session. But I'll read some more about SD-WAN to see if we can apply it.

emnoc
Esteemed Contributor III

The problem with outgoing with more than 1 IP is that we do use some banking applications, financial services that disconnect you when they recognize multiples IPs on a single session.

 

Then built a SDWAN for that destination/application and nail it to just one sdwan-member. I really do not see how a VPN is going to make this any better unless your planning a VPN to each institution 

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
srv4ever
New Contributor

emnoc wrote:

The problem with outgoing with more than 1 IP is that we do use some banking applications, financial services that disconnect you when they recognize multiples IPs on a single session.

 

Then built a SDWAN for that destination/application and nail it to just one sdwan-member. I really do not see how a VPN is going to make this any better unless your planning a VPN to each institution 

 

Ken Felix

I plan to use a VPN service, like ExpressVPN, and register that on the 3 WANs using L2TP to their exact same server.

Keeper_of_the_Keys
New Contributor III

If you use SD-WAN and have a rule that makes traffic prefer only one link, but why would you not use all the available uplink speed?

Labels
Top Kudoed Authors