Internet lease circuit on Fortinet directly

[sushil]

Hi, I am planning tpo use a 1:1 lease circuit from ISP in following way. ISP--->Fortigate(PAT/NAT)----->switch. The link should terminate on my fortinet wan interface instead of any cisco router before that. Now my isp has given me link on ethernet output with following summary WAN IP. 122.x.x.114/30 Gateway 122.x.x.113 LAN IP i.e the public IP.pool of 16 IP addresses in the range, 122.X.Y.32/28 to 122.X.Y.48/28. In some other configuarion(which was a year ago) i used it with a cisco router before the fortigate in such a way that WAN IP 122.x.x.114/30 terminating on one ethernet (e0)interface of router and used any of the LAN IP (i.e public IP) 122.X.Y.32/28 on ehternet 1(e1) and routed traffic on router like 0.0.0.0 0.0.0.0 to gateway of ISP i.e 122.x.x.113..Used one IP from pool 122.X.Y.48/28 and Natted on my fortigate with my local network and used 5 other public ips to publish my servers.This all seems worked perfectly fine. Now router is not there in current requirement.Need expert help how to achieve this?Can I use /28 mask ip address to use for NAT to my internal network as i did before or dedicatly needs to go with /30 mask ip address.How to route traffic.. Thanks in advance. Reg, Sushil

[sushil]

No answer?

[rwpatterson]

Because you really will not be able to (OK you can, but it will be confusing as heck!) route those same IP addresses from the inside to the outside, I would setup the device with the /28 subnet on the outside, use a private IP range on the inside, and use VIP definitions to point to the inside devices. This has the added benefit of being able to switch servers with a flick of an electronic switch. (Just change the destination on the VIP definition) Also this does not limit you to the 16 IP adresses that your ISP provided, you could go larger...

[darrell]

If you notice, the post states x.x on the isp network and x.y on the internal network. Based on that, I would assume they are on separate subnets. It appears you will be using public addresses behind the FG, so all you really need to do is set up policies on the firewall allowing the types of traffic you want to allow to nodes behind the firewall. It is pretty straightforward I think. However, it would be better if we understood as Bob mentioned whether or not you will actually use private addresses and just NAT. If it is, just set up VIPs (virtual IPs) and either port forward or statically NAT the connections.

[rwpatterson]

I never assume. Gets me into too much trouble....