Basic Configuration with multiple public IPs

[Albrecht]

hi,

I am trying to setup a FortiWiFi 40C to work with our network. I hope this is even the correct subforum. We have an adsl-modem connected to WAN1 of the FortiWiFi, a large switch on LAN1 for alle the client-PCs and a bintec elmeg hybird 300 PBX system for VoiP on LAN2.

Our ISP has given us 4 public IP Adresses as well as a gateway IP.

The Gateway IP is public.97, useable addresses are public.98 to public.102. Only public.98 is allowed for SIP-login for VoiP though.

What I am trying to achieve is to route all traffic for public.98 to the PBX on LAN2, and let the clients access the internet with public.99. For remote access to our NAS i would also need public.100 forwarded to the NASes IP on LAN1, but this is secondary.

Right now I configured the WAN-Interface to connect to the modem with PPPoE which works fine, but all clients now have public.97 as public IP.

Can somebody point me in the right direction what I have to configure?

[strike]*edit: We had a working setup with a small mikrotik-router, which I don't have access to, inbetween modem and fortiwifi performing the pppoe and probably routing of the IPs. The FortiWiFi would get internet access, if I could define a gateway to use. In the WAN-configuration I can only use manual mode, where I can only define an IP, but no gateway. For a quick fix, can I somehow configure the FortiWiFi to use public.99 as IP and public.97 (the Mikrotik Router) as gateway? In the long run I would like to eliminate or at least reset the mikrotik router to regain access. [/strike]fixed with static route to 0.0.0.0/0 via public.97

[ede_pfau · Accepted solution]

all clients now have public .98 as public IP - .97 is the gateway address on your provider's side.

In the outbound policies (lan1 to wan1 and lan2 to wan1), you can use IPpools for source NAT. If you only tick "NAT", source NAT will be done with the outbound interface address. In an IPpool, you can specify the address to use.

As your general internet traffic and VoIP traffic use different source interfaces, you have 2 different policies outbound, and thus can use different IPpools.

To direct inbound traffic from a public IP to a private IP (wan to LAN), you create a VIP (virtual IP). The VIP does destination NAT and exchanges the public.100 to the private IP of your NAS. Reply traffic as well as traffic originating from your NAS will use this translation as well - you don't have to NAT it's source address.

[Albrecht]

Ok, I'll try to get this to work on the weekend, when nobody is in the office. Is the following configuration of the FortiWiFi correct:

[ol]

WAN1: PPPoE to Modem, unnumbered IP public.99, no secondary IP configurable?

VIP from public.100 to internal IP of NAS with desired Ports to forward

For VoIP I'm a little lost to be honest. How do I route VoIP traffic from public.98 on WAN1 to a single LAN-Port?[/ol]

[ede_pfau]

1. PPPoE *assigns* a WAN IP, like with DHCP. That's why you cannot configure a primary or a secondary IP.

2. VIP is OK. Be aware that you can't ping the internal server (for testing) if you port-forward, only if you fully forward all traffic. Which is no security risk as you narrow down the services in the policy.

3. Traffic from WAN to internal server has to use a VIP. Traffic from LAN to WAN2, where the default route is pointing to WAN1, needs to use a Policy Route.

So plenty of stuff to read up on...