Configure four IPs public same wan

[Marcelo_Clementeen]

Hi...
I have a problem sleeping. I tried everything and could not configure. 
Here in the company has a dedicated link with 5 public IPs with the gateway 200.222.166.1 coming out of the same E1, connected in port2 of the 200G fortigate 
and port1 connected in the Switch. 
I need to configure each IP of this for different servers. In the same WAN (port2), Example: IP 200.222.166.10 for server 192.168.1.10, 200.222.166.11 for 192.168.1.11 .... 
anyone can help me. Thank you!

[Iescudero]

Hello!

You have to create a Virtual IP and then applied it on a firewall policy for accesing those servers from Internet.

This is just an Example through CLI:

1) Create the Virtual IP

config firewall vip edit "SERVER1" set extip 200.222.166.10 set extintf "port2" set mappedip "192.168.1.10" next

edit "SERVER2" set extip 200.222.166.11 set extintf "port2" set mappedip "192.168.1.11" next

edit "SERVER3" set extip 200.222.166.12 set extintf "port2" set mappedip "192.168.1.12" next

edit "SERVER4" set extip 200.222.166.13 set extintf "port2" set mappedip "192.168.1.13" next

edit "SERVER5" set extip 200.222.166.14 set extintf "port2" set mappedip "192.168.1.14" next

end

2) Then create a Firewall policy ( I think is better one policy for each VIP)

config firewall policy

edit 1 set srcintf "port2" set dstintf "port1" set srcaddr "all" set dstaddr "SERVER1"" set action accept set schedule "always" set service "ALL" set logtraffic disable next

edit 2 set srcintf "port2" set dstintf "port1" set srcaddr "all" set dstaddr "SERVER2"" set action accept set schedule "always" set service "ALL" set logtraffic disable next

edit 3 set srcintf "port2" set dstintf "port1" set srcaddr "all" set dstaddr "SERVER3"" set action accept set schedule "always" set service "ALL" set logtraffic disable next

edit 4 set srcintf "port2" set dstintf "port1" set srcaddr "all" set dstaddr "SERVER4"" set action accept set schedule "always" set service "ALL" set logtraffic disable next

edit 5 set srcintf "port2" set dstintf "port1" set srcaddr "all" set dstaddr "SERVER5""

set action accept set schedule "always" set service "ALL" set logtraffic disable next

Obviously, there's a serious risk when you put your servers to Internet, so be carefull and think everything twice. 

hope it helps!!

[tanr]

You may want to set match-vip enable on those security policies.

See https://forum.fortinet.com/tm.aspx?m=112129 for some discussion about it.

[Marcelo_Clementeen]

Escudero thanks for the feedback.
I made all the settings, but it did not work. What happens is as follows: From the router, only one cable is connected, which is connected to port 2 of the fortigate.
In the configuration of the interface of the fortigate is configured as 200.222.166.10 and when ping from outside only ping this ip and not the others (200.222.166.11, ... 12 .... 13).
Now the question is this:
1) How do I get the other public IPs to be released by port2?
2) Is my infrastructure wrong (Fortigate Port2 = WAN1 and Port1 = local (192.168.1.XX)?
3) Do I have to create different routes?
Thanks.