IP Range

[Degies]

Hi I have six public IP' s How would I add the range to the interface ? I know it is via CLI, but I cannot find the reference

[tpouzet1]

Question is, are your addresses adjacent ? If so, if you have 6 addresses I gess you have a /29 network (3 bits allocated to addresses) therefore 2^3 addresses, 1 for the network, 1 for broadcast, and 6 available for use. Quick example, let' s say your addresses are 192.168.0.65, 192.168.0.66 ... 192.168.0.70 The network address is 192.168.0.64 and the broadcast address is 192.168.0.71 The IP range is 192.168.0.64/29 (or 192.168.0.64/255.255.255.248)

[ede_pfau]

Even if they are adjacent, you can make use of them only by creating a VIP for each. Then, the FGT will proxy-arp for the public address, and hand over the traffic to some (mapped) internal address. Usually that is an internal server in the DMZ or such. See the FortiOS Handbook, Firewall-VIPs for more details.

[Degies]

tpouzet1 you are correct So I cannot add it as a a second ip since it is on the same subnet so how do I add the range?

[rwpatterson]

With Fortigates, you don' t add each IP to the interface. You create virtual IP addresses and point them inwards to the servers. If you put all the addresses on the outside interface, you would then have 6 ways to contact the firewall. Kinda useless. Re-read Ede' s reply.

[emnoc]

Ditto VIP is your answer and it easy to setup config firewall vip edit " VIP_2_39_xxx_80_25-FTP-SSLVPN-CLIENT-src" set extip 39.xxx.80.25 set extintf " EXT_NET01" set mappedip 10.10.100.10 next edit " VIP_2_39_xxx_80_26-mon01-testing" set extip 39.xxx.80.26 set extintf " EXT_NET01" set mappedip 10.100.100.254 next end Make sure you craft the correct fwpolicy and DO NOT select NAT.