Router on a Stick?

[Splitztkd]

Hi I have a 50b firewall that I want to use for remote access to my servers, but I don' t want normal traffic to pass through it as it does not have the throughput basically I want to hit my current firewall and pass through on 8443 and hit the 50b, from there it allows me to see the remote web interface and connect to servers etc. I have seen it done and I want to keep the current network config (default GW is 192.168.1 254) can someone tell me how this is done, if I connect to a server say on RDP from the 50b, how its the server going to know about routing traffic back to the forti 50b and not to the network DG? thanks Cliff

[Istvan_Takacs_FTNT]

Not sure if i understand what you want, only the router on the stick part of it. It' s possible by using different VLANs on the same physical interface. You can use VLANx for inbound traffic and VLANy for LAN access. Then configure the FGT policies to enable access between the 2. Routing can be done the same way as you would do it with physical interface, you just need to tag the packets with the correct VLAN IDs. If you want to keep the current network configuration/addressing, than you can create a transparent VDOM and deploy it on your network. It has a few limitations, but you would not need to change anything on your network to make it work.

[Splitztkd]

Ok Probably didn' t explain that too well.. what I would like to do is just use the 50b as a remote access portal, so it is part of the network but normal traffic does not go through it. so if I https to x.x.x.x:8443 from the outside it goes to the 50b and that displays the remote access web page then I can connect to servers from there. but all normal traffic bypasses the 50b. eg port 80 just comes in through the modem/etc direct to website server I just don' t want the 50b in the way of traffic flow as it cant cope... hence my (probably wrong) analogy or router on a stick. Just unsure of config requirements and if I would need anything different on the servers either. I had thought of using different vlans or ip addresses, but this is not possible due to other restraints in place Cliff

[Istvan_Takacs_FTNT]

You than have to configure it on your current firewall and can take an example from the Fortigate policy route configuration page. e.g if incoming traffic is hitting port 8443 than forward it to hostX. Everything else can be just delivered as normal. http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/adv_static_routing.021.28.html