Multiple IP Blocks on same interface

[nsantin]

Hi, forgive the rather simplistic question, my ISP is assigning us a second /28 ip block. Im using the ISP' s router which goes into my FGT100D cluster. I will now have 2 unique IPs as my next hop What' s the best way to setup our WAN interface to use this block of IPs? How do I setup the second GW address on the WAN interface? Do I just remove the existing GW IP and create 2 routes for both subnets to use the WAN interface? Or is there something I need to configure on the interface setup? If it' s just as simple as creating 2 static routes then why do we initially setup the interface with an IP address block to begin with? Or is that just optional " best practice" to begin with?

[ede_pfau]

Hello, long time no see... Basically you have a ' Dual IPS' configuration here. You can assign one of the new IPs as a Secondary IP address to your WAN port in use, specifying the correct network mask. Now you can use that IP like the primary, i.e. the FGT will respond to ARP requests etc. In contrast to the primary address, no route will be created by default. You will have to do that yourself. Running 2 (logical) WAN lines requires 2 default routes to the 2 next-hop-gateways. The keyword here is ' ECMP' and ' dual WAN' . You will find the concept and examples in the ' Advanced Routing' guide or here on the forums. Instead of balancing the outbound traffic equally between both networks you can direct specific traffic to one of the gateways - for whatever that' s good. Did you request additional public IPs to use them for internal servers/services? Otherwise I have a hard time to see the advantages for this (certainly it' s not load balancing).

[romanr]

Hi, if the mentioned /28 subnet is terminated on the same router and routing interface - You might be lucky and dont need to change anything on your interface setup and just use the additional IPs as virtual IPs in your setup! As the default gateway is the same there is also no need to change routing. br, roman

[nsantin]

Hi Ede! We' re bringing up a secondary DR site and my ISP will do BGP routing of my existing /28 between the primary site and the DR site. They gave me a second unique block (per site) so I can establish a VPN between the two sites to allow for data replication and general internet access at the failover site. All my inbound traffic will be on the primary block, all my outbound will need to go out on my second block (because the first block may not be active on the site). Looks like I' ll need to setup 2 routes for the outgoing traffic and either use IP Pools or PBR for the outgoing and of course setup my VPN. @Romanr, yes everything is terminating on the same interface on my ISP' s router. I think you' re right that little will need to change at the primary site, but I' ll need to setup the DR site to use the proper routes. My DR site will need to use the second gateway unless the primary gateway " comes up" , almost like load balancing but on the same interface. I guess I could setup two routes and have the primary one with a higher priority which will only come up if its active. This is challenging for me to test as Im not even sure how to setup my lab with 2 blocks on 1 router. New experience for me :)

[emnoc]

All my inbound traffic will be on the primary block, all my outbound will need to go out on my second block (because the first block may not be active on the site). Looks like I' ll need to setup 2 routes for the outgoing traffic , and either use IP Pools or PBR for the outgoing and of course setup my VPN.

You might to create a topology map of what your goal(s) are in the DR site solution. I would heed and warn you, that your DR should have NO dependency on the primary site. This is the purpose and the most critical function of a DR site.

[nsantin]

Hi emnoc, didn' t mean to add confusion my question. My DR site will include both DR servers that are replicated (over VPN from the primary) and some other servers/services that are local to the DR site only. My non-DR equipment and the " branch office" VPN will go over the second block of IP' s (hence my comment about " outgoing" ) and my DR servers will process incoming connections over the primary block in the event of a fail-over only (via VIP). I think I' ve got enough insight from you gents to start with (setup secondary IP on the WAN interface, add a manual second route, configure the VPN, setup PBR and Pools (if applicable), pull out hair, repeat). I' ve got a nice brand new pair of 100D' s arriving on Monday which I' ll start configuring and try to build this out. Thanks!

[romanr]

Hi, in the first posts it wasn' t clear, this is being about desaster recovery... After reading the information you posted afterwards, your target scenario still isn' t totally clear to me. Maybe outline it a bit a more? For building a DR site, I would follow some design rules: - Keep it simple! (Should be a generally design rule) - Especially on the IP layer - complex routing scenarios will make your daily administration more complex and bring possible sources of failure with it. - Use DNS for failover if possible (should be possible in 98% of all DR cases)- as failing from primary site to DR site will most likely have a human decision to failover involved. If this needs to be fully automated - services like Fortidirector might make your likfe easier! br, Roman