Route WAN IP internally with no NAT

[Coldfirex]

Howdy, We have a FGT80C (v4 MR2 P1) that has a static public IP with several additional IPs tied to it. We have several of these IPs setup as VIPs and are forwarded internally to their destination (NAT' d). We recently came across a scenario where we need to do the same thing but we cannot have the IP Nat' d (we need to give an internal machine the public IP). It will have 2 NICs (one for its internal IP so it can be reached internally, and then another for the public address). The only other time I did a setup like this I have the public NIC connecting to in front of the router. I was not sure where to begin on this. Would someone be able to point me in the right direction please? Thanks!

[ede_pfau]

Yes, sure. The support team knows what they say, most of the time. Imagine the second VDOM as a second independent hardware Fortigate; in transparent mode, you only have a management IP for accessing the Web GUI and CLI. There are no IPs set on the ports as the device is working like a bridge/hub/piece of wire. If later you need to be able to have traffic across the second VDOM to the root VDOM you can configure an inter-VDOM link. See the Admin Guide or Handbook for this.

[simonorch]

I' ve just come across a similar scenario today. Is this for an MS direct access server by any chance? A suggestion i got from a Fortinet SE was to (if possible) subnet these ' internal' public IP addresse and then just route as normal. In my case there' s also a LAN next to the server, also, if you were to put your WAN port in a transparent vdom, wouldn' t this cause problems with fortiguard?

[jtfinley]

It shouldn' t if the managing VDOM is accessible or move it to another VDOM.

[Coldfirex]

Thanks all. We implemented this last night (after getting an additional public IP block from our provider) and it worked like a charm. We setup a vdom on our 80C that is in TP mode, and then were able to plug directly into the server that has a public IP on it.

[ddskier]

Is it possible without using VDOMs? Perhaps using routing? I have 30 public IPs and I would like to use 20 of those IP on directly on equipment. The problem I have is that my firewall' s/router public IP is within the same range as my available IPs. Example: 172.16.1.1/27 (Not real IP)

[ddskier]

Bump. ?

[ede_pfau]

Why routing? The VDOM approach gives you the advantage of leading the traffic through the FG so you can have UTM on it. Alternatively you can put a switch in between FG and WAN connection and connect your servers directly. They are on the same subnet. The only way to protect them is to put a transparent mode FG in front - and that is what the second VDOM is.