Routing for two different gateway

[yongsan]

Hi, I have a 60B in transparent mode and 1 server behind the firewall running on public ip address. Now they need to have a new set of ip addresses for their server. Due to the ISP unable to extend their existing IP range, they will be given a new set of IP addresses. So here is what i hope to achieve: WAN1 - X.X.X.X/28 WAN2 - Y.Y.Y.Y/28 The server eth0 will set the ip address of X.X.X.X and eth1 will set ip address of Y.Y.Y.Y. So is it possible to route to different gatway in transparent mode? Do i need to revert to NAT mode? If yes, how should i go about doing it? Thanks! Yongsan

[rocampo]

In transparent mode Fortigate will just pass traffic from one port to another port (like a bridge), it will not route it. IP address on the Fortigate in transparent mode is just for Management. If you want to do policy based routing you will need to be in NAT/Route mode. You change operating mode of the FG on Dashboard, System information. Make sure you backup the configuration of the FG before changing the operating mode. Depending on your setup you can migrate from transparent to NAT mode like this. Assign IP addresses to WAN1 and WAN2 of FG based on your ISP addresses. Assign private ip address for your server. Define Virtual IP for WAN1 and WAN2 pointing to your internal ip of server. Define 2 default routes and necessary firewall policies to allow traffic. Define the policy based routes on the FG.

[ede_pfau]

As rocampo wrote, the Fortigate does not route at all in transparent mode. There is nothing special if your servers are configured with different gateways and IP' s. You can put the Fortigate into routing mode and lead the traffic via Virtual IPs to the servers but what for? Leave it as it is and you' re fine IMHO.

[yongsan]

Hi Ede, Does that mean that I can still keep it as transparent mode and set the public ip address on my eth0 and eth1 and it will know how to go out?

[rocampo]

You will need to define two default routes on your server. Assuming this is a Windows Server 2003/2008 having two default routes with the same metric this will probably (not entirely sure) cause problems. So you need to set 1 default route at a higher metric. You will also need to configure " Dead Gateway Detection" so that the Server can adjust its routing table if ever one of your ISP links goes down. Now weigh the pros and cons of keeping the FG in Transparent mode as to converting it to NAT mode where all the routing and " dead gateway detection" will be handled by the FG elegantly. For me an FG facing the internet in NAT mode is much more flexible than an FG in transparent mode.

Does that mean that I can still keep it as transparent mode and set the public ip address on my eth0 and eth1 and it will know how to go out?

[ede_pfau]

In transparent mode, think of the FG as a wire. Well, a wire is a layer 1 device and a transparent bridge is a layer 2 device - it will buffer packets, regenerate them if necessary, adjust link speed etc. but will not influence layer 3, routing. This is done on your servers. As you already have more than 1 public IP you could test this with a second IP and a second server. BTW, do you feel confident to have your servers directly connected to the Internet?

[Jan_Scholten]

I@ede_pfau: f you have the fortigate in transparent mode between the servers and the internet and you do IPS/AV/and firewalling on the transparent fortigate.. do you see a problem there? Of ycourse you can imagine a scenario with someone bridging around the fortigate. I would also agree that, when you have to access the servers from internal it is probably more elegenant to access a RFC IP. But i do not see a general problem with a transparent fortigate infront of internet servers. (But that is not really relevant to the thread starter). If starting new i' d probably go with nat/vips and ecmp, but i think it should do they way it is setup now.

[ede_pfau]

Hi Jan, in the transparent scenario, the servers have to deal with all connection attempts from the internet. My feeling is that a Fortigate can deal better with DoS attacks. Who cares if the firewall is running hot as long as the servers can deliver their content? And think of all the security holes in a general purpose OS. There are so many services running that it means a lot of work to secure them all. MS keeps discovering holes all the time. And not only the OS is exposed but the applications also (IIS, apache,...). I hope that at least they do their remote management not via RDP directly (but use the transparent mode IPSec VPN of the FG). Right, yongsan?

[Jan_Scholten]

If you have a transparent firewall in front of the servers with proper policys in place the exposure of applications is only on the allowed ports.And this ports/aplications are also exposed if the server is in a dmz with nat and policies. If there is a permit any any policy in the transparent fgt you are right..

[ibm_ioman]

You ca try using VDOMs, one vdom in transparent mode doing what the FG is doing right now, the other in NAT mode, for the new settings.