How to exclude an IP from a range on an interface?

[Owain_Deagle]

I have been provided by my ISP a non-consecutive selection of IP' s. 66.18.202.151-158, excluding .153 Also I need to point one of those IP' s at a second router. I am using a 80CM as the primary, and a 50C as a secondary. What interface configuration do I need to create on the 80CM, to only include [.151,.152,.154,.156-159]? Currently the WAN1 interface on the 80CM is set to " 66.18.202.151/255.255.255.224" . Is this where the secondary IP option comes into play? I tried to find information about it in the documentation but failed. I am using MR2 Patch 9 on both devices.

[ede_pfau]

Hi, you should only assign one IP address to your FGT' s wan1 port, and use the others in VIPs (virtual IPs). Use of secondary IP addresses is recommended against as this would prevent anti-spoofing control. Your public IP range is .151 - .158 (not .159 as stated further below). One possible network mask is 255.255.255.240 (= /28). This is the smallest mask which covers your range. Available IPs for hosts/routers are .151 to .158 .159 is the broadcast address which cannot be assigned. So ' wan1' would get the 66.18.202.151/28. For the second router, create a VIP on the wan1 interface, mapping 66.18.202.152/32 to an internal 192.168.222.1 (or whatever), no port forwarding. Same holds true for any publicly accessible server. If you want your second router to face the public then you would have to plug it into a switch together with the FGT wan1 port and the cable from the provider (that is, in parallel) and assign it a free public IP address. You see that it really doesn' t matter at all that the public IPs are not consecutive.

[Owain_Deagle]

ORIGINAL: ede_pfau Hi, you should only assign one IP address to your FGT' s wan1 port, and use the others in VIPs (virtual IPs). Use of secondary IP addresses is recommended against as this would prevent anti-spoofing control. Your public IP range is .151 - .158 (not .159 as stated further below). One possible network mask is 255.255.255.240 (= /28). This is the smallest mask which covers your range. Available IPs for hosts/routers are .151 to .158 .159 is the broadcast address which cannot be assigned. So ' wan1' would get the 66.18.202.151/28. For the second router, create a VIP on the wan1 interface, mapping 66.18.202.152/32 to an internal 192.168.222.1 (or whatever), no port forwarding. Same holds true for any publicly accessible server. If you want your second router to face the public then you would have to plug it into a switch together with the FGT wan1 port and the cable from the provider (that is, in parallel) and assign it a free public IP address. You see that it really doesn' t matter at all that the public IPs are not consecutive.

Hi Ede_pfau, Thanks for the information. Maybe I' m going about this the wrong way already. It' s possible my lack of understanding about some networking basics is where the problem is. I had assumed that I needed to make sure each router was only " listening" on the IP' s it needed to be on. I want both routers to be public facing. I have each WAN1 port plugged into a switch, along with the DSL modem. The primary router (80CM) has 66.18.202.151/255.255.255.224 on WAN1, with some VIP' s to route mail/http/https to the mail server. In reality this router only needs an IP for management, and an IP to pass through for the mail server. The secondary router (60C) has 66.18.202.155/255.255.255.0 on WAN1. I don' t need any VIP as there is nothing behind this router at all. It' s just to be used for VPN testing, so all I need is to be able to manage remotely. At this point I can' t access the 60C remotely at all (PING, HTTPS, SSH are allowed on management, but nothing connects). And anything plugged into it' s internal ports cannot get out (current firewall policy is allow everything in and out, but no dns resolves, or it can' t contact any DNS server). I' m not worried about the outbound from the internal ports as I' m sure I can resolve that later if need be. It' s the remote management that' s at issue (and of course VPN connectivity for testing). I' d guess the reason I can' t remotely touch the 60C, is I have the WAN1 on the 60C incorrectly assigned.

[rwpatterson]

ORIGINAL: Owain Deagle The primary router (80CM) has 66.18.202.151/255.255.255.224 on WAN1, with some VIP' s to route mail/http/https to the mail server. In reality this router only needs an IP for management, and an IP to pass through for the mail server. The secondary router (60C) has 66.18.202.155/255.255.255.0 on WAN1. I don' t need any VIP as there is nothing behind this router at all. It' s just to be used for VPN testing, so all I need is to be able to manage remotely.

66.18.202.155/255.255.255.0 and 66.18.202.155/255.255.255.224 are not the same... I guess you already figured that out.

[Owain_Deagle]

ORIGINAL: rwpatterson

ORIGINAL: Owain Deagle The primary router (80CM) has 66.18.202.151/255.255.255.224 on WAN1, with some VIP' s to route mail/http/https to the mail server. In reality this router only needs an IP for management, and an IP to pass through for the mail server. The secondary router (60C) has 66.18.202.155/255.255.255.0 on WAN1. I don' t need any VIP as there is nothing behind this router at all. It' s just to be used for VPN testing, so all I need is to be able to manage remotely.

66.18.202.155/255.255.255.0 and 66.18.202.155/255.255.255.224 are not the same... I guess you already figured that out.

I' m feeling particularly thick today, I don' t understand what you mean?

[ede_pfau]

Don' t worry. Sorry, Bob, sure there' s a difference when you assign network masks of different sizes. You (Owain) mentioned that the 80CM' s wan1 port carries a /27 netmask whereas the secondary router carries a /24 netmask. The effect is this: the network mask determines the size of the address space that the device can reach locally, that is, it' s neighbourhood. If you have 2 devices in the same address range (like .151 and .155) and one has a broader neighbourhood range then...no problem! Both can still reach all hosts in the smaller range of both. BUT (and I guess that' s what Bob hinted at) you will have problems reaching hosts in the larger address range. This is getting convoluted, sorry. I' ll give you an example: Say, your local address space is 66.18.202.150-158 host1: 66.18.202.151/255.255.255.224 sees .145 - .158 as local devices host2: 66.18.202.155/255.255.255.0 sees .1 - .254 as local devices If you try to connect to .158 both will succeed, as it' s local. If you try to connect to .140 only host1 will succeed (it knows .140 is not local, so it connects via routing) but host2 will fail as it deems .140 to be local which it isn' t. Long story short, you should use the smallest network mask covering all of your addresses. Back to your problem: why you cannot reach the secondary router is wild guessing at the moment. We just need more information. - what is the ISP' s gateway IP address? You should be able to look it up on the 80CM, System>Network>Interfaces>wan1. - what is the default route on the 60C? - if you put the .155 on a VIP on the 80CM, can you then use it?

[Owain_Deagle]

ORIGINAL: ede_pfau Don' t worry. Sorry, Bob, sure there' s a difference when you assign network masks of different sizes. You (Owain) mentioned that the 80CM' s wan1 port carries a /27 netmask whereas the secondary router carries a /24 netmask. The effect is this: the network mask determines the size of the address space that the device can reach locally, that is, it' s neighbourhood. If you have 2 devices in the same address range (like .151 and .155) and one has a broader neighbourhood range then...no problem! Both can still reach all hosts in the smaller range of both. BUT (and I guess that' s what Bob hinted at) you will have problems reaching hosts in the larger address range. This is getting convoluted, sorry. I' ll give you an example: Say, your local address space is 66.18.202.150-158 host1: 66.18.202.151/255.255.255.224 sees .145 - .158 as local devices host2: 66.18.202.155/255.255.255.0 sees .1 - .254 as local devices If you try to connect to .158 both will succeed, as it' s local. If you try to connect to .140 only host1 will succeed (it knows .140 is not local, so it connects via routing) but host2 will fail as it deems .140 to be local which it isn' t. Long story short, you should use the smallest network mask covering all of your addresses. Back to your problem: why you cannot reach the secondary router is wild guessing at the moment. We just need more information. - what is the ISP' s gateway IP address? You should be able to look it up on the 80CM, System>Network>Interfaces>wan1. - what is the default route on the 60C? - if you put the .155 on a VIP on the 80CM, can you then use it?

Ok a days rest has made this all the clearer. So for the secondary router (60C), it' s probably best to put the WAN1 interface at 66.18.202.155/32? If I do this then it stops being visible from external sources. If I set it to /27 it becomes visible. I was able to determine the gateway IP by looking at the default route on the 80CM, it' s 66.18.202.129. It did not appear to be visible in the System>Network>Interfaces>wan1 section. This would explain why at least a /27 netmask is needed. So that the gateway is in the local address space. I checked the 60C, and it had no default route. So I created a route 0.0.0.0/0.0.0.0 with Gateway of 66.18.202.129, just like the 80CM. Now I can ping and access the router remotely via IP. All i need to sort out now is outbound webtraffic, which appears to be a DNS error, as nslookup fails from a machine plugged directly into the 60C' s internal ports. I' ll show you how i' ve got the internal ports setup: IP/netmask: 192.168.30.1/24, DNS Query set to Recursive DHCP: 192.168.30.100-200, Gateway 192.168.30.1, .... and I' ve fixed it. I had the DHCP dns set to 192.168.30.1, I changed it to System DNS setting, and it now works. All is resolved, for the moment! Thanks so much! Though if you see anything I' m doing clearly wrong here please let me know.

[ede_pfau]

OK, the /27 netmask is right but your gateway is NOT local. How do you connect on the WAN side, per DHCP or PPPoE? Regarding the 60C, you had everything right the first time. I always let the FGT be DHCP server and DNS. Possibly DNS doesn' t work on the 60C. Try a ' exe ping www.google.com' from the console window. If that doesn' t resolve to an address the DNS system setting is wrong. One other reason would be if you didn' t allow DNS out in your LAN to WAN policy. Then the system DNS setting could be correct but that wouldn' t help your hosts much.