Route a subnet to a fortigate Interface-how to get fgate to to take it

[John_Loop]

Sounds like a simple question...? Fortigate with Internet IP 1.1.1.1 on port7 (e.g.). I route the Internet subnet 2.2.2.0/24 from the internet to this interface. Diag sniffer packet port7 sees them hit interface. NAT vdom port 7 to port 8. Port 8 has private address 10.1.1.1. I have a DNAT (VIP) setup to convert 2.2.2.X to 10.1.1.X on incoming pkts. I have policy to send 2.2.2.0/24 to the VIP. Fortigate never recognizes 2.2.2.X pkts - traffic log never sees them. How do I get fortigate vdom to take " responsibility" for 2.2.2.0/24 subnet? I REALLY need to take a good fortigate course. Boss claims no money. This forum will have to do! Thanks John

[SECCON1MC]

Hello John, I' m not sure if I fully understand your configuration. But I believe based upon what you have provided you just need to multi-home (secondary IP) the main internet interface 1.1.1.1 to also include 2.2.2.X/24. This will then allow the Fortigate to ARP for the the other IPs you have configured in your VIPs. Without this the IPs do not show as a connected route and thus it will not work. Good luck!

[John_Loop]

Thanks for your reply. I was eventually able to get it to work. I did not want to add a secondary to the interface because I wanted the entire subnet sent to the fortigate, just like a router. Independent of the VIP table, I figured out to add policies to allow services on the individual IP addresses in the 2.2.2.X/24. Dealing with these policies can be very frustrating. Initially I thot this was port translation - but of course not. Port translation can be done in the VIP. Thanks again!

[ede_pfau]

In this case, the VIP does the arp replies (proxy-arp) for the hidden internal IP address. That is, a VIP translating 2.2.2.2 into 10.1.1.x will reply to an arp request for 2.2.2.2, as the 10.1.1.x will never see it. Using VIPs instead of secondary IPs is almost always the better way.

[John_Loop]

Thanks for the info. I am not sure why the VIP has to proxy-arp, but I guess inside the fortigate they are still doing classical stuff, as least " virtually." Learning the DNAT and Source NAT is tricky stuff. In my case, I still need to add the blanket policy statement to allow all out with NAT enabled, using the interface IP. Those in the VIP NAT table get the 2.2.2.X address heading out, anybody NOT in the table gets NAT' d using the interface 1.1.1.X address. whew...

[ede_pfau]

If it helps, NAT is applied after passing an outbound policy. So in the policy you deal with the un-NATed addresses. The VIP ' has to' proxy-arp by design; it conceals that the host reacting to connections sometimes is the FGT, and sometimes (for permitted/intended traffic) is the internal server.