Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Damitha
New Contributor

Configuring one source IP to use Multiple Internet IP addresses

Hello

 

I have a requirement to distribute internal server > outgoing emails among multiple IP addresses. Is there any way to achieve this? I tried using IP Pool, but it doesn't work as when there is only one source it is using only one IP address from the pool to send the traffic out. Please help.

5 REPLIES 5
isaravia
New Contributor

Did you define Network > Interfaces > internal (Name of your Interface) (type Hardware Switch)?

 

emnoc
Esteemed Contributor III

I doubt you can do that your choice would be to build ip alias and rotate thru them in a ip nat pool

 

e.g

email-server

  10.10.1.11 SNAT 38.0.2.11

  10.10.1.12 SNAT 38.0.2.12

  10.10.1.13 SNAT 38.0.2.13

 

Many email compaign delivery servers works in the above fashion and they just shoft thru SNAT ip-pools to keep the number of email originating per pubic-ipv4 down to a minimum.

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Damitha
New Contributor

Hello Ken

 

Thank you for the reply. But how can we get three aliases (source IPs) from the email server?

lobstercreed

Another way to approach this in a load-sharing (not round-robin/load-balance) fashion is to specify different NAT pools based on the destination address. 

 

If you're using Central NAT this would mean specifying multiple Central NAT policies for example from email IP to 0.0.0.0/2 using one public, from email to 64.0.0.0/2 using another, and so on.

 

If you're not using Central NAT, you can do the same thing with multiple firewall policies.  From email IP to 0.0.0.0/2 and select a single 1-to-1 NAT, then copy that for the other 3.  Just have to make sure you don't have a policy matching from email IP to "all" above those rules.

emnoc
Esteemed Contributor III

We call that splitting the internet 

 

0.0.0.0-127.255.255.255 0.0.0.0/1

128.0.0.0-255.255.255   128.0.0.0/1

 

you can even go smaller but if your destination are always in the top or bottom half of the internet with /1 you might not get the achieved results. if you use ip alias , than the src-ip is the determining factor as to what snat you use imho

 

YMMV

 

Ken Felix

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors