Pass WAN1 external IP to DMZ

[MarkB]

I have a block of IPs from my ISP 174.xx.xx.129/27.  I have a number of VIPs and policies set up to direct various of these IPs from WAN1 to the correct devices on my internal interface.  I have a need to give one of the IPs as-is to another router for use as its WAN address.  How do I set up a rule which would send 174.xx.xx.143 to the DMZ without changing it?

Fortigate 60D in NAT mode

TIA, Mark

[AtiT]

Hello,

Your subnet is 174.xx.xx.128/27 Probably your FortiGate is addressed from this subnet. I would suggest divide this subnet to smaller ones.

Let's say your gateway is 174.xx.xx.129 and the FortiGate 174.xx.xx.130 - it is the 174.xx.xx.128/30 subnet.

Your other free subnets will be (I hope): 174.xx.xx.132/30 174.xx.xx.136/29 174.xx.xx.144/28

Ask your ISP to route these subnets to yout FortiGate 174.xx.xx.130.

At this point you can use these addresses (all of them) for VIP as they are the host routes.

Also you can make smaller subnets for poin-to-point links - so if you need a router in DMZ and no other device will be on the same network but everything will be after this device (router) than you can use the next available subnet 174.xx.xx.132/30 where the FortiGate DMZ's IP will be .133 and the DMZ router .134. Or if you need public addresses in your DMZ you can use the /29 or /28 subnet for servers.

It depends on the design but probably it is enough to set a VIP (1:1 NAT) rule to the connected router's IP and do an Override NAT for that IP address accessing the Internet. Do you really need the 174.xx.xx.143 address assigned directly to the router's interface?

[rwpatterson]

Alternatively, you could create a soft switch and place two interfaces into that switch: One for the gateway out, the other for your router. This would put additional load on the FGT because all the router traffic would have to pass through the soft switch, but it should work in theory. This would be the equivalent of plugging the FGT and router into a two port switch connected to the gateway router.

My two cents

[ede_pfau]

There's no difference between a VIP on the 'internal' interface, and a VIP on 'dmz'. So the answer is very very simple: create a VIP just like you've done before.

The FGT will even answer arp requests on behalf of the device in the DMZ (proxy arp).