Pass through IP question

[#1]

I' m not having much luck setting this up and was hoping for feedback. This was all setup before my arrival. Our ISP' s router feeding into our Fortigate-60 and is just doing straight passthrough. The IP of WAN1 is a.b.c.2 with a netmask of 255.255.255.224 We' ve split the traffic to internal (going to 192.168.a.x) and the DMZ (192.168.b.x) Typically we NAT everything we want to show on the outside, and don' t have an issue with it. We have a router from our phone provider that needs to be setup with an external IP address and will not work with NATing. So we' ve set the IP address of this device to a.b.c.28 with the 255.255.255.224 netmask and plugged it into the DMZ switch. How can I set the Fortigate so that it will pass traffic through to that IP (specifically PPTP traffic) without NATing it? Any help would be greatly appreciated.

[g3rman]

Here is one way: Create a rule: Internal -> External Source: 192.168.a.x Destination: a.b.c.28 Action: Permit Nat: unchecked This will allow traffic from your internal network to hit the VoIP router without being translated. Please make sure that this rule appears in your rulebase ABOVE any other rule which permits traffic outbound from the 192.168.a network. Also, you need to add the following route on your VoIP router: Destination: 192.168.a.x Gateway: a.b.c.2 This is needed so the router can get back to the internal network.

[UkWizard]

putting the phone router in the DMZ wouldnt work, if it absolutely needs to physically have a public IP, then it has to be outside of the firewall on a spare IP address. So this is effectively also plugged into the WAN-ISP Router network. This obviously means your phone router is unprotected by the fortinet. But this is what would happen if they insist on a public IP. there is one other way to do it, but requires you to lose a chunk of your provided ISP IP range, and you would need to work with the ISP to reconfigure their router to narrow the subnet and add routes to your fortinet (to essentially put a subnet of your current range on another internal network. this would also require a spare interface port as well.

[g3rman]

Or you can ask your ISP for another block of 4 or 8 IP addresses to assign to a " public DMZ" .