Please review new network scenario with /30 subnet between WAN intf and ISP router

[zorro]

Hi

Hope somebody could review this scenario and come up with some hints.

I have Fortigate 300D as a typical perimeter firewall. On external interface (WAN) I have larger public IP subnet of size /26. WAN interface terminates several IPSec site2site tunnels, most part of internal traffic is NAT'ed (overload) to that interface's IP, all server NATings or port forwardings are defined as VIP where public IP is from that /26 public subnet. Some of servers use IP_Pool option in order du source NAT exactly to wanted static public IP.

But now, my ISP wants to use a transport net (/30 subnet) between my WAN interface and their CPE router. So I will get a new public /30 subnet on WAN interface, and I am wondering where do I move my /26 public subnet? Do I need to configure it on some other interface or should I define it on a new loopback interface? What happens to site2site VPN traffic then? I haven't find any guide for this kind of scenario.

Ideas and hints are highly appreciated!

BR Zoran

[Toshi_Esumi]

I haven't done but likely moving the /26 to secondary IP/subnet on the WAN interface would work without any other changes. Somebody else, please correct me if I'm wrong.

[zorro]

Thanks for great the idea, Toshi!

I think that solves my concerns about terminating IPSec VPN tunnels as well. Fortinet says clearly in doc that VPN can be terminated on secondary IP, but nothing about terminating VPN tunnel on another interface, not directly exposed to Internet.

BR Zorro

[Toshi_Esumi]

That part I can tell that it doesn't matter if it's on the outside interface or any other interface as long as the route is there so that the remote side can reach the IP/interface.

[zorro]

Hi Toshi,

I did the change and everything went smooth and as planned :) Thanks for tips!

The only thing I needed to fix was VPN tunnels. I had to specify "local-gw ip" in each ipsec phase1 profile which was necessary to make ipsec traffic source from "old" and now secondary interface IP address.

BR Zorro