Add another public ip pool provide by my ISP

[5q46n2te8jPWJY]

Hi,

I currently have a Fortigate with a /29 public IP pool on my WAN interface. I have requested more IP addresses from my ISP.

I need some help to determine the best configuration scenario for an ongoing installation. Here are the details provided by our supplier:

1. Direct Routing: The supplier suggests that the IP packs be directly routed to our equipment. For this, I need to provide them with the IP addresses of our equipment for our three sites.

2. Secondary Configuration: Another option is to configure the IP packs as secondary on the LAN of their routers.

I would like to know:

• Which option is better in terms of performance and security for our Fortigate equipment?
• Are there any specific implications (such as NAT configuration, routing, etc.) that I should consider for each option?
• Any experiences or recommendations on managing this type of configuration would also be highly appreciated.

Thank you in advance for your advice and feedback!

[Toshi_Esumi]

• It has nothing to do with either security or performance. It's just another public IP subnet however it's delivered.
• It's up to you, how you want to use those additional IPs and why you requested it. Do you want to use them for VIPs to map them to specific local devices? or do your internal devices need to have a public IP each and you need to route them through your FGT?

Toshi

[5q46n2te8jPWJY]

Thank you, 

Yes I want to use VIP and map local device. I think first scenario is the better. 

What I have to do in Fortigate? It's the first time I'm doing this. 

[funkylicious · Accepted solution]

If they route the new public IP space through the existing link as the next hop your FGT, then you just need to configure the VIPs ( DNAT ) / IP Pool ( SNAT ) and the firewall rules for the traffic on the FGT.

[5q46n2te8jPWJY]

Thank you, 

I will try this! 

[Toshi_Esumi]

I would agree. For the second option, you would waste totally 3 IPs otherwise you could use for VIPs: subnet address like .0, FGT's secondary wan interface IP, and broadcase IP like .7 if /29.

If option 1, basically nothing additionally you have to do. You just need to give them the current FGT's interface IP in the current /29. Then you can keep confguring VIPs with any of new 8 IPs (if /29).

Toshi

[funkylicious]

Hi,

To be honest, I always prefer to have the new subnet routed through an existing link, so that I can decided how to use it and where.

If I don't need public IPs directly configured on devices in LAN and only required to do SNAT/DNAT with it, it's a lot more flexible for me to use it for different scenarios.

If they want to do secondary on their device that means that you would also have to configure it as a secondary on your FGT ( i am not a fan of secondary ip spaces ) and would not be able to configure/assign IPs from that space to any device directly and you would also 'lose' 1 IP for usage since it's connected/configured on PE and CPE ( FGT ) .