Basic New Setup IP Question

[FirewallNoob]

Hello,

I am adding a new IP range to our WAN1 port and came across a weird issue/confusion on how the fgt is defining these fields in the GUI. I am probably overthinking it, but are we supposed to put in the full Assigned LAN Netblock address with /28 the IP assigns me in the fgt Network/Interfaces/edit WAN1 "IP/Netmask" field, or just the first LAN Usable IP (205.105.155.146/255.255.255.240 - or 255.255.255.255)? Same goes for my static routes. The ISP gave me a Default Gateway for LAN Netblock to use - that should be my static route, correct? 0.0.0.0/0.0.0.0 as the IP/Mask and 205.105.155.145 for the Gateway under Router/Static/Static Routes?

Example of what we were provided, including explanation from ISP:

Assigned LAN Netblock  - 205.105.155.144/28

Subnet Mask: 255.255.255.240

LAN Usable IPs: 205.105.155.146 through 205.105.155.158

*You mas assign these IPs to your LAN (LAN Default Gateway, PC, Workstation, Firewall, etc)

Default Gateway for LAN Netblock: 205.105.155.145

*This will be the IP that all devices use as a default route or gateway for your LAN back to your router.

Config is ISP > 100Mbit managed Adtran router in bridged mode > WAN1 of FGT > flat HP network switch. No VLANs or anything.

Thanks!

[rwpatterson · Accepted solution]

You assign the interface a single address in the correct subnet. The other addresses in the range need to be assigned Virtual IP addresses (VIPs for short) from the Fortigate. The Fortigate will answer requests to these IPs and pass the traffic to the NATted device on the other side.

[neonbit · Accepted solution]

You would configure your wan1 interface with the address 205.105.155.146/28.

Your default gateway would be 0.0.0.0/0 and 205.105.155.145 as the gateway address.

[rwpatterson · Accepted solution]

You assign the interface a single address in the correct subnet. The other addresses in the range need to be assigned Virtual IP addresses (VIPs for short) from the Fortigate. The Fortigate will answer requests to these IPs and pass the traffic to the NATted device on the other side.

[FirewallNoob]

Thank you RW, that seems clear. But, what should those numbers be in my example?

I am not a network engineer but noticed (we have two) fortigates..one uses the first addressable IP at the IP/Network mask and another uses the 3rd IP/Network mask. Furthermore, one uses an unusable Default gateway for a static route and another uses the last IP in the usable range?

What gives?

What is best practice?

Thank you for any help - these Fortigates are unconventional to me in terms of how they define these interfaces, wizards and help lookup. Cisco - no problem. Very clear. 

[neonbit · Accepted solution]

You would configure your wan1 interface with the address 205.105.155.146/28.

Your default gateway would be 0.0.0.0/0 and 205.105.155.145 as the gateway address.

[rwpatterson · Accepted solution]

neonbit wrote:

You would configure your wan1 interface with the address 205.105.155.146/28.

Your default gateway would be 0.0.0.0/0 and 205.105.155.145 as the gateway address.

More clearly, the IP address could be anything BUT 205.105.155.145 because that is the default gateway. The route should be 0.0.0.0/0. And the gateway IP is 205.105.155.145.

[FirewallNoob]

Makes sense, thank you both for confirming. I'm not sure why these existing ones use something completely different. They are working fine, but it struck me as strange how they were configured.

[MikePruett]

What are the differences you are seeing?

Some ISPs will give you a /30 for your WAN interface and then route the usable addresses to that address. That is nice as it frees up address space you would have had to use otherwise for your WAN interface.

[FirewallNoob]

Aha - I found the original documentation from the ISP for FG1: 

FG#1:

from ISP:

"You have 13 static IPs 205.98.40.129-205.98.40.141 Gateway IP: 205.98.40.142"

WAN1 = 205.98.40.129/255.255.255.240

Static Route = 0.0.0.0/205.98.40.142

Ultimately, that is why it confused me. I assumed it was 205.98.40.128/255.255.255.240 and the gateway would then be 205.98.40.129, not .142...just like:

FG#2:

From ISP: 188.179.178.240/255.255.255.240

WAN1 = 188.179.178.242/255.255.255.240

Static Route = 0.0.0.0/188.179.178.241

The change in location of the gateway and WAN1 starting IPs are what tripped me up. ISP1 has the gateway at the end of the range and ISP 2 has it at the beginning. Instead of 14 usable IPs for ISP#1, they assigned 13 and just blocked out the rest of the range. I didn't realize this until i found the original documentation.