Multiple public IP on one wan port (2 networks)

[DamianM]

Hi all, I have problem with configuration multiple public IP on one Wan port. Our provaider set as one public adres on 176.x.x.x.x/30 and then set 8 addicional public IP adresses on 89.x.x.x/29 (4 to use). Everythink is agregated on one wan port. I would like to use one of 89.x.x.x adresses to use it for our webserver.

Interface on our Fortigate is configured on 176.x.x.x network. How can I use addicional IP's?

In "IP Pools" there is no options to set gateway or mask for 89.x.x.x network. How to set this?

[Toshi_Esumi]

A common way to provide additional public subnets by ISPs. You seem to have decided to do mappings from those public IPs to servers' private IPs, instead of routing by assigning it on a LAN interface. Then  you need to configure VIPs for inbound (DNAT) and use ippools (SNAT) for oubound to/from those servers. There are many articles in Doc libraries or on the internet for these. I listed a few below.

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/510402/static-virtual-ips

http://itadminguide.com/one-one-static-nat-configuration-fortigate/

By the way, if you get a /29 additional subnet and use all of them as VIPs/SNATs, you should be able to use all 8 IPs. If you decided to just route them to LAN side (means servers have public IPs) the FGT takes one IP (ex. .1) and the rest, 5 IPs (ex. .2 - .6), should be usable for servers except the subnet (ex. .0) and broadcast (ex. .7) addresses.

[sw2090]

You cannt use all 8 IPs in a /29 because the 1st ist the network address and the last is the broadcast address. So it is 6 usable addresses in /29.

[Toshi_Esumi]

Yes, you can if you use VIP/SNAT in most cases as I stated. You, of course, can't use sbnet/broadcast address if your "route" the subnet.

[emnoc]

Correct.

As long as the /29 is not assigned to interface but routed to the firewall you can use all 8  address.

Ken Felix

[DamianM]

So my 60F is configured:

WAN1 - interface set to 176.x.x.x\30 network.

WAN2 - interface ser to my other provider set as backup.

I have set two static routes 0.0.0.0 - wan1 gateway and 0.0.0.0 - wan2 gateway. If Wan1 is down first route is turn off. I have my webserwer in LAN. And now.

1. I have set VIP 89.x.x.x (second free adress) to webserver adress.

2. I have set webserver in Adresses.

3. I have set 89.X.X.X form 1. in IP pools as Overload and set ARP Relay.

4. I have set policy wan to lan with destination to VIP in 1 with turn off NAT.

5. I have set policy lan to wan with NAT on and IP Pool configuration set on 3.

What I am missing?

[DamianM]

I have found what I was doing wrong.

In secondary address I have added all network address not a specyfic address from VIP. And now I can use all 6 avalible adresses.

[maick78]

Hi DamianM,

I recommend you configure Vlans for each network (2 VLANs). So you add them to the port and also to the SD-WAN, in the SDWAN configuration you can put the gw of those networks.

Also remember that you can implement it in a LACP.

S2s