PPOE secondary IP

[Mattlemon]

Hi, I have installed a 60D with an adsl router acting in bridged mode so I configured the 60D with the PPOE credentials and it connects fine. However, the client had two IP addresses previously on a PIX firewall and I need to be able to use this 2nd address too. Anyone come across this before? The IP assigned by the ISP has a /32 subnet mask :( Thanks, Matt

[AndreaSoliva]

Hi " If" the secondary IP is routed to the already using /32 of the firewall you can use two possibilities: --> Add to the PPoE interface a virtuelle Address which means over the Gui: System > Network > Interfaces > [choose your PPoE Interface] > [Below the Gui activate Secondary Address] > [Enter the second IP as /32] --> Use a static ARP entrie for the secondary address which has to be entered on the CLI: # config system arp-table # edit 1 new entry ' 1' added # get id : 1 interface : ip : 0.0.0.0 mac : 00:00:00:00:00:00 # set interface [Name of interface example " pppoe" # set ip [IPv 4 address] # set mac [MAC address of pppoe Interface] # end In this way the device/firewall knows that the corresponding interface is responsible of the IP/Subnet. The disadvantage of the ARP is that it has to be known that such a entry exisits because the entry itself is not visible over the gui. This means also in migration scenario it has to be known that this ARP entry has to be done. From this point of view the most people are using Secondary Address over the gui for such a config. The overall thing which is important is that the ISP " has to be" route the scondary IP address to your first IP address used on the PPoE interface or you have to route the secondary address from your router to your PPoE interace. This can be tested in this way that you configure the stuff and afterwards you test with a ping or tracert and in the same time you sniff on the PPoE interface with the command: diagnose sniffer packet [name of interface] " host [public IP address of host you are testing]" Have fun Andrea

[ede_pfau]

@Andrea: why would the FGT NOT respond to arp requests for the secondary address without the manual entry into the arp table? I don' t use secondary addresses often but if I do they are served just like primary addresses.

[Dave_Hall]

Under 4.0 MR3 (and I assume 5.0 as well) you lose the secondary IP option once the interface is configured for a PPPoE connection (just doesn' t show up, even if you use " full-configuration" ). The closest option to setting an IP on the interface (PPPoE mode) is the " ipunnumbered" option. Never used it myself nor able to test that option. I think we need more information here; like are both static IPs from two differnet subnets with default gateways? Are these IPs routable on the Internet or NATed through the ISP? You may have better luck going to the DSL modem to see if there are options for setting up a block of ipnummbered IPs (see attached pic as an example). But next question I have is how that info is relayed to the Fortigate.

[AndreaSoliva]

Hi regarding the question: " why would the FGT NOT respond to arp requests for the secondary address without the manual entry into the arp table? " I think we have here a misunderstanding. A secondary address on a main interface has not a under normal circumstances a seperate MAC meaning ARP entriy. This is the reason why it works. Example: If you have a interface with IP 192.168.1.1/32 this IP takes the MAC of the main interface like 00:00:00:AA. If you configure now on the same interace a secondary address like 10.10.10.1/23 the scondary address is also listening on the MAC from the main interface like 00:00:00:AA. This meanis if in this segment a ARP request " who is" will be launched and as replay " I am" will be launched from the main interface regarding the secondary address with MAC 00:00:00:AA. If you do a manual ARP entry you do the same meaning IP 10.10.10.1/23 for MAC 00:00:00:AA. Both are functioning in the same way the only difference is that the secondary is listining on a virtuelle interface. The best way to explain is if you look to linux. Main interface is eth0:0. If you use a secondary address on the eth0:0 it will at leas be represented as eth0:1. If you do a manual ARP entry on linux the eth0:1 is not existing because the config is done in the static ARP table. This is the reason I explained the advantage and disadvantag of ARP static and secondary meaning the secondary you see on the gui and on linux at the name of the interface. If you do a static ARP you do not see it except in the ARP table to be as static ARP entry which will also exisit if you flush the ARP table. Hope this verifies your question. Have fun Andrea

[ede_pfau]

Call me dumb but I still haven' t grasped the difference fully... Both ways, the FGT will reply to arp requests with the physical' s interface MAC address. Even if you flush the arp table, for both methods. The only difference I can spot is that I would be able to configure a different MAC address with a static arp table entry. Why would I do that, would it work for traffic... maybe I get it later. Thanks for the time anyway.