/30 - /24 on on 1 WAN link

[jbrunk]

Hello everyone i have been researching multiple forum posts on my scenerio and i found a couple that are kind of like it but nothing that says best practice or for mu situation the best way to do it. We have purchased 100D's and have them in a HA cluster. We have a P2P 67.x.x.x/30 with them. The ISP then Static Routes the 98.x.x.x/24 Subnet to our 67.x.x.x/30 GW in our FW now. I have read the best way to hand out the 98/24 is to use VIP's which i understand how to configure this. here is my issue and was hoping i could get some assistance. (the HA cluster is not production yet).

1. 98.x.x.254/24 is our EXT GW that we terminate all our VPNS to. With that being said do i need to add a second IP address to my EXT WAN link? with the 98.x.x.254/24 or is there a better way of doing this.

2. I need all my internal network to show it coming from the 98.x.x.254 when they go out to the internet. when i Source nat i would assume i can tell it to use this address? if so where and what would be best practice etc.

Thanks.

James Brunk

[emnoc]

So that /24 is connect to what now?  If it's an alternate and external device you could place /32 host specific routes pointing to your next-hop that reaches the fortigate and drop VIPs on the fortigate.

Do you have a topology map/drawing.

[jbrunk]

Hello,

Ok ill try to explain this another way, 

ISP router > FW 67.x.x.x/30 P2P, 

ISP has a Static Route that says 98.x.x.x/24 next-hop 67.x.x.x/30 FW L3.

FW > has 2 L3 assigned on 1 WAN Link 67.x.x.x/30 & 98.x.x.254/24

WE have multiple branch offices that all terminate VPN's to the L3 IP address 98.x.x.254/24 on our FW, I need to set this up on the Fortigate so i can terminate all my VPN's to the 98.x.x.254 address, ? was should i just assign the 98.x.x.254 address on the WAN1 link as a secondary IP address? or is there a better way of doing this. I need to have the 98.x.x.254 as a L3 address on the fortigate so i can terminate our VPN's to it.

Right now when you go from internal network to the Internet (whats my IP address) shows 98.x.x.254/ (Port-range), i need to setup this also on the fortigate and was hoping to get a best practice way of doing this also.

thanks

[jbrunk]

Hello,

I got this figured out.

1. set a secondary IP address on the Wan1 connection with IP 98.x.x.254/24

2. On my Policy from Internal to External on the Nat part i did a dynamic IP pool and set its range as 98.x.x.254-98.x.x.254.

I setup a Laptop on the internal network and pinged an external IP to another FW, that FW shows the Ping coming from the IP of 98.x.x.254.

thanks

[jbrunk]

Hello,

The ISP has a Static Route that says 98.x.x.x/24 next hop 67.x.x.x/30 which is our P2P connection on our FW to the ISP router. so the /24 is carried over this /30. 

1. If all of our VPN's now terminate to the 98.x.x.254 address i would think i need to put this on the Fortigate also so i can terminate them to it. if so where do i just add this ip as a second IP on the Wan link? I think this is the way im going to have to do it but want to know if there is a better way. 

2. when i source nat i need all my internal to external traffic to show as the 98.x.x.254 IP. just want to know what is the best way of doing this also. 

thanks

[emnoc]

Still confused on "98.x.x.254" vpn terminated. Are these vpn terminated on the firewall and if yes to what ( loopback  interface/secondary/etc....)

If the "98.x.x.0/24" is carried at the  firewall currently and over the /30, than just add VIPs for the address you are going to use.

A simple topology map would explain alot, but I took the time to daft one for you on what I THINK IT IS . Just add or tell me what device(s) carries the /24 currently?