Hello,
In my network I have FortiGate 100D. In WAN1 i have addres xxx.xxx.xx.101/29. Now I want to install a Fortigate 30e for one of segments my network so I need to configure one of adresses frome class xxx.xxx.xx.101/29 as WAN1 on Fortigate30E. How should I confgure Interfeaces on FG100 and FG30?
In other network where I have to IP classes on WAN interfaces so I can adreess WAN 2 in FG100 and WAN1 on FG30 to diffrent addreses.
In this case when I try address a WAN2 i have conflict with subnet on WAN1.
So i new configuration I will have ISP WAN -> FortiiGate 100D -> FortiGate30D
hi,
and welcome to the forums.
Create a VIP on the 100D for a second public IP (not used on the 100D's WAN interface), and as the 'mapped-to' address you fill in the (private) WAN address of the 30E. You can put the 30E on your LAN, or create a small transfer subnet between an unused port of the 100D and the WAN port of the 30E.
The VIP will even act as a source NAT for traffic coming from the 30E, no need to worry about that.
To make the VIP effective, you need to use it in a policy on the 100D:
src intf: WAN
dst intf: LAN (for example, the port the 30E is connected to)
src addr: ALL
dst addr: my_VIP (!)
no port forwarding
service: ALL
no NAT
Thank you for replay.
So I should set private ip on un used port on FG 100 for x 10.100.0.1 and 10.100.0.2 for WAN1 on FG 30?
If i don't have a external IP configured on this F30 may I configure a VPN conection Site to Site between two FG's ?
Your suggestion for IPs is correct.
EVERYTHING is a bit more difficult if the FGT doesn't face the internet directly. Either try it out, or put the VPN on the 100D. It's more powerful anyway.
Ok, thank you suggestion. Now is everyting is clear to me.
BTW. Is there any way to configure this two FGT to use one of my External IP to "face FG30" directly to internet? Mayby I shoud use some switch before my FG100 ?
If your ISP has one of /29 IPs as GW, having a switch and connect both FGTs to let them directly talk to the GW is the most common/natural way regardless if it's a FGT or any other FW or router.
Agree with Toshi. Why not use a small WAN switch? Way less problems with VPN, FortiGuard etc.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1846 | |
1130 | |
769 | |
447 | |
260 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.