Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
prince
New Contributor III

ISP Secondary IP address

Dear support,

I'm seeking guidance regarding my current network setup and the configuration required to enable internet access using the ISP-provided LAN IP pool (1.1.2.2/29 subnet) via our Fortinet firewall.

Currently, our Fortinet firewall's WAN interface is configured with the WAN IP pool address (1.1.1.1/30), and it's functioning seamlessly. However, we now aim to utilize the ISP-provided LAN IP pool (1.1.2.2/29) to enable internet connectivity using IP addresses within this subnet.

Any detailed instructions or guidelines you could provide regarding these configurations would be immensely helpful in achieving this setup.

2 Solutions
adimailig

That is fine as long as the ISP has route set on ISP network for 1.1.2.2/29 pointing to your network at 1.1.1.1/30. 
For example:

IP POOL (1.1.2.2/29) >> FGT <1.1.1.1/30> ---- <1.1.1.2/30> ISP Router ---- Internet
* ISP Router have static route 1.1.2.2/29 gateway 1.1.1.1

On the fortigate we will use IP Pool. It means that outgoing traffic will be having source IP 1.1.2.2 when it hit the ISP Router. Traffic will be accepted by ISP Router and forwarded to internet.
Return traffic will hit ISP Router and since it knows how to get to 1.1.2.2 ISP Router will forward return traffic to FGT 1.1.1.1.


Best Regards,

Arnold Dimailig
TAC Engineer

View solution in original post

Toshi_Esumi
SuperUser
SuperUser

First, the additional /29 subnet should be described as 1.1.2.0/29 then 1.1.2.2 is just one of IPs in it.


Two more ways to utilize the additional /29 subnet in addition to SNAT with ippool @adimailig explained.

 

2) use them for DNAT/VIP to map those individual IPs to internal servers like a web server, FTP server, etc. to let outside parties to access those servers.

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/728694/destination-nat

3) lastly, your ISP's assuming usage for the subnet as a "LAN" subnet is to use the /29 on one of LAN interfaces on the FGT(router). Nothing different from the default 192.168.1.0/24. Just pick one IP from /29 like 1.1.2.1 and configure it on the LAN interface, then use the rest 1.1.2.2 - 1.1.2.6 for the LAN devices. Their GW is of course 1.1.2.1.
Only difference for this is the policy(ies) for this LAN interface to the internet should have NAT/SNAT disabled. This is the traditional way of using an additional subnet with a simple L3 router from the beginning of the internet.

The ippool SNAT option and DNAT option can be combined if you want or need, and you can utilize all 8 IPs, 1.1.2.0 - 1.1.2.7.  With the last routing option, the usable IP is only 1.1.2.1 - 1.1.2.6 while 1.1.2.0 is subnet address and 1.1.2.7 is broadcast address.

 

Toshi

View solution in original post

7 REPLIES 7
adimailig
Staff
Staff

@prince 
You may utilize/configure IP Pool (1.1.2.2/29) and use it on your firewall policy.
What will happen is Source IP will be translated to one of the IP from IP Pool.

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/29961/dynamic-snat

Note that ISP should have route on their network going to 1.1.2.2/29.

Best Regards,

Arnold Dimailig
TAC Engineer
prince
New Contributor III

ISP has provided Wan IP pool address in 1.1.1.1/30 subnet and ISP lan pool address is in 1.1.2.2/29 subnet. both the IP address are in different subnet.

adimailig

That is fine as long as the ISP has route set on ISP network for 1.1.2.2/29 pointing to your network at 1.1.1.1/30. 
For example:

IP POOL (1.1.2.2/29) >> FGT <1.1.1.1/30> ---- <1.1.1.2/30> ISP Router ---- Internet
* ISP Router have static route 1.1.2.2/29 gateway 1.1.1.1

On the fortigate we will use IP Pool. It means that outgoing traffic will be having source IP 1.1.2.2 when it hit the ISP Router. Traffic will be accepted by ISP Router and forwarded to internet.
Return traffic will hit ISP Router and since it knows how to get to 1.1.2.2 ISP Router will forward return traffic to FGT 1.1.1.1.


Best Regards,

Arnold Dimailig
TAC Engineer
prince
New Contributor III

thank you for the valuable support. it helped for me. 

Toshi_Esumi
SuperUser
SuperUser

First, the additional /29 subnet should be described as 1.1.2.0/29 then 1.1.2.2 is just one of IPs in it.


Two more ways to utilize the additional /29 subnet in addition to SNAT with ippool @adimailig explained.

 

2) use them for DNAT/VIP to map those individual IPs to internal servers like a web server, FTP server, etc. to let outside parties to access those servers.

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/728694/destination-nat

3) lastly, your ISP's assuming usage for the subnet as a "LAN" subnet is to use the /29 on one of LAN interfaces on the FGT(router). Nothing different from the default 192.168.1.0/24. Just pick one IP from /29 like 1.1.2.1 and configure it on the LAN interface, then use the rest 1.1.2.2 - 1.1.2.6 for the LAN devices. Their GW is of course 1.1.2.1.
Only difference for this is the policy(ies) for this LAN interface to the internet should have NAT/SNAT disabled. This is the traditional way of using an additional subnet with a simple L3 router from the beginning of the internet.

The ippool SNAT option and DNAT option can be combined if you want or need, and you can utilize all 8 IPs, 1.1.2.0 - 1.1.2.7.  With the last routing option, the usable IP is only 1.1.2.1 - 1.1.2.6 while 1.1.2.0 is subnet address and 1.1.2.7 is broadcast address.

 

Toshi

prince
New Contributor III

Thank you for your valuable support. both the solution helped for me. thanks a lot

adimailig

@prince 
You're most welcome! 

Cheers!

Best Regards,

Arnold Dimailig
TAC Engineer
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors