Problem with External IP on second FG.

[filu]

Hello, 

In my network I have FortiGate 100D. In WAN1 i have addres xxx.xxx.xx.101/29. Now I want to install a Fortigate 30e for one of segments my network so I need to configure one of adresses frome class xxx.xxx.xx.101/29 as WAN1 on Fortigate30E. How should I confgure Interfeaces on FG100 and FG30? 

In other network where I have to IP classes on WAN interfaces so I can adreess WAN 2 in FG100 and WAN1 on FG30 to diffrent addreses. 

In this case when I try address a WAN2 i have conflict with subnet on WAN1. 

So i new configuration I will have ISP WAN -> FortiiGate 100D -> FortiGate30D 

[ede_pfau]

hi,

and welcome to the forums.

Create a VIP on the 100D for a second public IP (not used on the 100D's WAN interface), and as the 'mapped-to' address you fill in the (private) WAN address of the 30E. You can put the 30E on your LAN, or create a small transfer subnet between an unused port of the 100D and the WAN port of the 30E.

The VIP will even act as a source NAT for traffic coming from the 30E, no need to worry about that.

To make the VIP effective, you need to use it in a policy on the 100D:

src intf: WAN

dst intf: LAN (for example, the port the 30E is connected to)

src addr: ALL

dst addr: my_VIP (!)

no port forwarding

service: ALL

no NAT

[filu]

Thank you for replay. 

So I should set private ip on un used port on FG 100 for x 10.100.0.1 and 10.100.0.2 for WAN1 on FG 30? 

If i don't have a external IP configured on this F30 may I configure a VPN conection  Site to Site between two FG's ? 

[ede_pfau]

Your suggestion for IPs is correct.

EVERYTHING is a bit more difficult if the FGT doesn't face the internet directly. Either try it out, or put the VPN on the 100D. It's more powerful anyway.

[filu]

Ok, thank you suggestion. Now is everyting is clear to me. 

BTW. Is there any way to configure this two FGT to use one of my External IP to "face FG30" directly to internet? Mayby I shoud use some switch before my FG100 ? 

[Toshi_Esumi]

If your ISP has one of /29 IPs as GW, having a switch and connect both FGTs to let them directly talk to the GW is the most common/natural way regardless if it's a FGT or any other FW or router.

[ede_pfau]

Agree with Toshi. Why not use a small WAN switch? Way less problems with VPN, FortiGuard etc.