IP address conflict when setting up FortiGate 60E

[icystr123]

I have a new FortiGate 60E that I have connected in this way:

ISP 1 WAN -> WAN1

ISP 2 WAN -> WAN2

Port 1 -> external network switch to LAN

I'm not getting any network connectivity to the external switch from the FortiGate 60E.

Whenever I log into 192.168.1.99 it gives me a notification that says "The IP address of interface "internal" conflicts with the DHCP address received by interface "wan1""

The IP address of "internal" is 192.168.1.99/255.255.255.0

The IP address of "wan1" is 192.168.1.110/255.255.255.0

I've tried changing the IP address of "internal" to 192.168.2.99 and also 192.169.1.99. I've also tried changing the IP addressing mode to "DHCP" and also "Dedicated to Fortiswitch" but it seems no matter what I do the FortiGate immediately gets disconnected when I submit the change and I can't log into it again unless I perform a factory reset. Am I doing something wrong here?

[Toshi_Esumi]

If you can't change the subnet with ISP's router (I think you can if it's a decent modem/router), you need to change your internal interface to something else other than 192.168.1.99/24. When you change it, like 192.168.2.99/24 you need to change DHCP server config on the internal interface to reflect the change on the interface. Otherwise, the devices you hook up on the LAN couldn't get a proper ip within the new range.

[icystr123]

Thanks for your reply. I managed to change my ISP router IP address to 192.168.3.1 which also changed the subnet of everything attached to the ISP router to 192.168.3.X. As a result I now can't log into the fortigate at all. I'm guessing its because the subnet should be 192.168.1.X? I've tried factory resetting multiple times but I haven't been able to get back in

[Toshi_Esumi]

You're not coming from Internet side (via ISP router) to get in the FGT, are you? Then your local login interface is still internal. There is no reason to lose connectivity. Regardless I recommend using the console access (CLI) when you change the local interface config on the FGT.

[ede_pfau]

Your FGT wan1 port now has received an address in the subnet 192.1683.0/24. Find out which and use it for login.

Or, if you have physical access to the FGT, hook up the serial cable to the Console port, start Hyperterm or PuTTY, 9600/8/N/1 and log in. Then you can look up which IP wan1 has gotten.

port1 still has got 192.168.1.99/24, so if you put .1.100 on your notebook/PC you should be able to login via this port as well.

[Dave_Hall]

I think you only need to change the "internal" or LAN IP subnet on the ISP router/gateway device and the DHCP settings handing out info to the CPE equipment (e.g. the fgt), this includes the DNS info.

If you are on site, connect your laptop directly to the ISP router/gateway device and see if you can browser/access the Internet - if not, troubleshoot accordingly.

Thing to watch out is a possible DNS related issue - trying pinging out both by FQDN and static IP (e.g. 8.8.8.8). 

If your ISP router/gateway device can be placed into bridge mode: e.g. assigning the CPE a public IP then I suggest considering going that route - personal opinion though.

If the ISP router/gateway can not be placed into bridge mode, see if there are any firewall settings that would allow you to set up port forward or see there is already one on it.   The port forward should be directed to the fgt's internal IP that is handed out by ISP router/gateway.

Not really needed, but it does help with troubleshooting is to set up DDNS setting on the fgt for the WAN(1/2) port.