ISP with WAN and LAN IPs

[DTech]

Hello, We currently have a rental Cisco router from our ISP, which is connected to a Fortigate 60C, and planning on upgrading the Internet connection. We plan on not renting the router from our ISP and instead will be using a Fortigate 60D. Our ISP uses two external IP addresses; one WAN and one LAN, which is currently configured on the Cisco router. Here is the current configuration: ISP Cisco Router WAN Port: 66.X.X.17 - LAN Port: 210.x.x.32 Fortigate 60C WAN Port: 210.x.x.33 - LAN Port: 192.168.1.1 The Cisco WAN Port is connected to the ISP facing port and the LAN Port is connected to our Fortigate 60C WAN Port. Our ISP has the Cisco WAN IP (66.x.x.17) pointing to the LAN IP (210.x.x.32) on their end, so that the 210.x.x.32 address can be accessed externally. Once the Internet gets upgraded, there will be a new WAN IP from the ISP, but will point this new WAN IP to the current LAN IP (210.x.x.32). Question: How would I configured the Fortigate 60D to replace the Cisco router and Fortigate 60C? Thanks.

[abc987]

Hi DTech and welcome to the forums. Is this Cisco any kind of network termination from your ISP? In this case I think you should not replace it.

[DTech]

Thanks abc987. The Cisco is not a network termination. The Cisco will need to be replaced, as it doesn' t support the faster speed.

[Jack_Gerbs]

Because you have public addresses on your LAN side of the Cisco, and you are looking to have private address on your lan and you want to only use 1 device to do this, I would setup 2 VDOMs, one called ISP and the other called Private. the ISP VDOM should be configured similarly the Cisco. The output of the ISP VDOM would then go to the Private VDOM. You did not indicate the subnet mask for the LAN side of the Cisco device, but input to the Private interface would obviously have to be in the same subnet. You have a few more decisions to make, depending on your comfort level with the Fortigate. You will have to have either use intervdom links or physical interfaces to connect Private to ISP VDOMs. If you don' t use intervdom links you will have to put the FGT in port mode and create soft switches. All this isn' t difficult if you really understand the FGT, if you are new to FGT, I would encourage you to work through this as it will be a great learning experience. I' ll keep an eye on this thread, good luck.

[DTech]

Thanks Jack for the suggestion. I' m new to FGT and will definitely try your suggestion on creating VDOMs. Probably will need some help on this. Will keep you posted.

[Phill_Proud]

You could also assign the current ' LAN' public IP subnet as a secondary IP subnet on the fortigate WAN. You can then use these IPs in VIP' s/NAT IP Pools etc for services that may be in your LAN or DMZ/etc.

[DTech]

Thanks Phill for your suggestion. I' m new to Foritgate. What do you mean by VIP' s/NAT IP Pools etc for services that may be in your LAN or DMZ/etc?

[rwpatterson]

NAT Pool = source NAT VIP = Destination NAT Fortinet parlance