How to connect an ISP' s modem to FGT80C

[Thanasis]

Hello to everyone I' m trying to figure out how to setup a Fortigate 80C (NAT mode). There' s an ISP' s vdsl modem/router which do the NAT We want to use that modem with the Fortigate. There are some issues though. 1. We are not able to change the ISP' s modem to bridge mode 2. We cannot disable NAT on that device. 3. We have only one static public ip. 4. The ISP informed us that we cannot use another vdsl modem/router from the market. Thank you in advance

[emnoc]

Get another ISP , no just kidding So you want NAT mode? So does the ISP -adsl modem kick out a private address via DHCP? If yes just configure your fortigate for DHCP on the external interface, And build your policies iaw to what your allowing from the inside -----> outside. If you later want or need more public address, you will need you ISP assistance.

[Thanasis]

Emnoc thanks for the reply So, you' re telling me to connect the ISP modem to the wan interface of the FGT, and then create the appropriate policies? Shall i enable " Nat" on the policies? If yes, double NAT will take place which is not very good :) Keep in mind that there' s already an active connection on FGT wan1 and also, the FGT works as a DHCP server.

[ede_pfau]

No, as long as you don' t enable NAT in a policy the FGT is not NATting, just routing. But, you will have to enable NAT in outgoing policies as the ISP' s device doesn' t know about your internal private LAN address space. So, double NAT. Please clarify: - which " active connection" do you mean? from where to where? - the FGT will have to do DHCP on the ' internal' interface. No DHCP server on ' wan1' necessary. But, as emnoc posted, you need to enable ' DHCP' as the interface type of ' wan1' in the Interface setup.

[Thanasis]

Thanks for the reply -There' s already an active Internet connection on WAN1 (from a different ISP). And i wan to enable the WAN2 for internet access, that' s why i created this post. -Got it! So, from what i read, the double NAT is a one-way solution, right?

[LG]

Did you ever get this working? We are trying to figure this out also with limited knowledge on the Fortigates.

[neonbit]

What exactly to you want to do with the FGT in your network? If it doesn' t have to be in NAT mode then you could implement it in transparent mode and not worry about double NATing or funky routing.

[emnoc]

So, from what i read, the double NAT is a one-way solution, right?

Will yes but not sure by what you mean by one-way. You can double nat if that' s what you really want. Example, I regularly access the internet on my own FGT that doe nat into a dhcp-dynamic assigned address from a rfc1918 pool behind another fgt does the public NAT. No back to you setup, if you want to operate 2 ISP, you could use wan2 or any other freed port and assigned gateway detect , static routing or PBR and dynamic NAT behind traffic exiting that interface. You would need to draw out your topology on what you want.