FortiGate behind a Verizon FIOS G1100 residential connection

[goldtop_66]

Hello,

First post here, and I am new to Fortinet products. I am looking to replace an EOL'd WatchGuard firewall with a FortiGate (e.g., 71F/G). Its a Verizon FIOS residential circuit using their G1100 Quantum router behind their ONT. That means: (1) the G1100 cannot be placed in bridge mode, (2) Verizon does not issue publicly-routable static IPs to residential customers, and (3) the WAN side of my firewall will be getting a local (i.e., non-routable) address from the G1100. The WG operates in this unfortunate double-NAT situation acceptably - it gets its updates and it moves traffic. A couple of other relevant details: (1) elimination of the G1100 isn't acceptable due to a MOCA requirement for three set top boxes, and (2) those set top boxes are on the other side of my firewall (i.e., the current WG firewall is the single point of connection for my network to the G1100 LAN side). Also, I am not currently using a VPN client to connect to my network from the Internet, but would like to allow that once the new FG is in place. I understand a ddns service will be necessary, as will port forwarding for select ports in use by the VPN.

I have read a lot of forum posts and the FG Admin Guide, trying to confirm whether or not a FG firewall will operate in the described environment. I've read forum posts where it is indicated that the FG must have a publicly routable IP at its WAN or it will not receive updates or push notifications (not entirely sure what those are just yet). I have read posts where getting the VPN working was the problem to be resolved, thus inferring that the FG will get updates behind the double NAT. I have not yet been able to confirm the FG will function in a double-NAT environment. I have struggled to get pre-sales technical support from Fortinet and from the two distributors I have contacted. In fact I've struggled to get a quote for a firewall and four 100-series switches, but I can be patient working that problem if I know the equipment is going to operate in this environment.

Can I get a confirmation that this is a supported scenario? Please let me know. Thanks for whatever help you can offer. Much appreciated.

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Toshi_Esumi]

It's not about WG or FGT or any other FW devices, but it's about if your FIOS home service is via CG-NAT or not. Probably any FGT would be able to do what your current WG is doing. But if your service is behind CG-NAT, the public IP seen from the outside is shared with multiple customers, therefore, any access like dialup VPN to the public IP wouldn't be delivered to your circuit exclusively. 
I haven't dealt with any FIOS home circuit (we have a FIOS business with a static IP) before so I can't tell either way but somebody else might know about it in this community.

One thing you can try yourself without asking VZN if it's CG-NAT or not is getting in the VZN's modem/router (if you have access) then check what IP it's pulling from the GW/NAT device in VZN. If it's something like 100.64.x.x, it's most likely CG-NAT. It might show in your trance route toward the internet.
Asking them should be the most sured way if they can provide the answer.

Toshi

[goldtop_66]

Thanks for responding. I ran a tracert to Google. Results:

Tracing route to www.google.com [142.250.80.100]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.1.1
2 1 ms 1 ms 1 ms Fios_Quantum_Gateway.fios-router.home [172.16.0.1]
3 8 ms 10 ms 4 ms lo0-100.BLTMMD-VFTTP-314.verizon-gni.net [71.179.30.1]
4 10 ms 10 ms 7 ms ae1314-20.BLTMMDCH-MSE01-AA-IE1.verizon-gni.net [100.41.21.164]
5 * 22 ms 16 ms lag-5.NWRKNJMD-PPR02-CC.ALTER.NET [140.222.19.237]
6 18 ms 14 ms 17 ms customer.alter.net [65.208.85.162]
7 18 ms 15 ms 17 ms 209.85.244.105
8 20 ms 17 ms 17 ms 142.251.65.115
9 13 ms 31 ms 18 ms lga34s36-in-f4.1e100.net [142.250.80.100]

Trace complete.

First hop is my existing WG firewall gateway. Second hop is the FIOS router gateway. The FIOS router reports its WAN side IP address as one in 98.117.X.X, as does running a reverse IP lookup. There are two Verizon address pools between me and the Internet, and that's not including the immediate 98.117.X.X segment the FIOS router is connected to.

Running a tracert to my own IP address (i.e., the 98.117.X.X address on the WAN side of the FIOS router) results in two hops.

Tracing route to pool-98-117-X-X.bltmmd.fios.verizon.net [98.117.X.X]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.1.1
2 1 ms 1 ms 1 ms pool-98-117-X-X.bltmmd.fios.verizon.net [98.117.X.X]

Trace complete.

I believe this indicates I am on a CG-NAT system, correct? Would it prevent the FortiGate from getting its security updates? I don't know how Fortinet pushes those out. Does the FG request updates? Does Fortinet use push? that's the question I really need to get answered.

Inbound VPN is a separate matter.

[Toshi_Esumi]

98.117 range is one of VZN's general ranges. Unlikely CG-NAT. Tracerouting the 98.117 IP from inside wouldn't give you any info. You have to traceroute from the internet side. I assume you can ping it if the FIOS router is allowing ping on wan interface.

CG-NAT IP range is generally below as in Google's AI overview:
The Carrier-Grade Network Address Translation (CGNAT) IP range is 100.64.0.0 to 100.127.255.255. This range is reserved for use by Internet Service Providers (ISPs).

And most FortiGuard services need only in-to-out access to the FTGD servers. Otherwise, it wouldn't work at all if the FGT is placed behind any NAT devices. It's designed to work much smarter than you're thinking.

Toshi