VDOM NAT/Transparent mixed question

[dvdsmith]

I' ve been reading up on Virtual domains and I think I know how I want to proceed. However, if I' m horribly wrong I hope someone will tell me before I go any further. I have an FGT-100A operating in Transparent Mode. For reasons I' m not going to bore you with the router upstream of WAN1 is on the same subnet as the internal interface and everything is configured statically. The router provides access to a T1. For illustration the router IP is 10.0.0.1. I also have a cable modem I' d like to put on WAN2. I will not be doing load balancing as certain PCs on my LAN need access to resources available via the WAN1 router, while it would be best due to bandwidth for the rest to go out WAN2. If I created two Virtual Domains, one in NAT mode on WAN2 and the other statically 10.0.0.2 on the Internal interface, could I make it so that traffic using 10.0.0.1 as a gateway would use WAN1 and traffic using 10.0.0.2 would use WAN2? I know this is a simplification but this message is long enough as it is. Should I just give up and put a router upstream of WAN2? Thanks, Dave

[laf]

Hy, First of all I am not sure I understood your scenario: - how router on wan1 is on the same class as internal ? If it has two interfaces there will be two different IPs, right? Or you can subnet to use the same class, but only half of it to an interface and the other half to the other, right? - another imp thing you should know is that you can NAT in Transparent mode, too. Offcourse if you are to use VDOMs you can use NAT mode, but keep this in mind. - if it' s possible, post a sketch of your network. Regards, laf.

[dvdsmith]

Laf, thanks for responding. I' m getting some sort of VB script error when I try to upload an image, so I can' t post a sketch. So I' ll make an attempt in ASCII. T1----Firewall/Router(10.0.0.254)----WAN1(FG100A,10.0.0.1,Transparent Mode)Internal-----LAN(10.0.0.0/24) Systems on the LAN current have 10.0.0.254 set as their gateway. Now I have a Cable Modem I' d like to use as a alternative on WAN2, not a failover or load balance. The end result being that systems using 10.0.0.254 would continue to use WAN1 as the gateway, while those configured with another IP (10.0.0.1 if possible) would use WAN2. I see a couple of alternatives here. I first considered leave everything as is, buy a router, give it an IP on the local subnet, put it between WAN2 and the Cable Modem. My main problem here are its an additional point of failure and it is something else to maintain. Can configuring NAT in transparent mode accomplish this? Is using VDOMs a better way? Thanks, Dave

[laf]

Ok, now I get the picture. It would shameful to add another equipment to your network. So Vdom1 - Transparent mode (you' ll assign a 10.0.0.x IP for management). - a cable from your access switch to the DMZ1 - a cable from wan1 to your router1 - protection profile applied on your dmz1 to wan1 policy with all the options you need Vdom 2 - you have to assign two internal 10.0.0.x managements IP' s (and this two IPs will make you the NAT; read on kc.forticare.com the article about) - then connect the switch to the dmz2 - use wan2 for reaching Internet. - add the firewall policy with the right protection profile. I think this would be all, and no need to use the FG management IP for routing. In Transparent mode, FG is like a switch passing traffic and just having a management IP.

[dvdsmith]

Laf, I think I understand most of this, however I do have a couple questions. Currently I have just the root VDOM. Do I use it as the first VDOM, or do I need to create two new ones? With the cable modem connected to WAN2, WAN2 needs to use DHCP, so I assume the second VDOM needs to be in NAT mode. Also the IP assigned by the ISP isn' t permanent, but occasionally changes when the lease is renewed. I read about " Configuring NAT in Transparent Mode" on kc.forticare.com, and it says the 2 management IPs need to be on separate subnets. Is this incorrect? Thanks, Dave

[dvdsmith]

I' ve created a VDOM and assigned it WAN2 and INT2 so I can experiment. It is in NAT mode, WAN2 configured for DHCP, INT2 with a local subnet IP, policy for INT2>>WAN2. For some reason WAN2 isn' t getting an IP via DHCP. " get system interface" at the CLI returns; name: wan2 mode: dhcp ip: 0.0.0.0 0.0.0.0 status: up netbios-forward: disable type: physical mtu-override: disable If I plug the cable currently in WAN2 into my laptop, it gets an IP via DHCP no problem. Am I missing something obvious? Dave

[dvdsmith]

Forget what I said about DHCP not working, the " modem" just needed a reset. Dave

[dvdsmith]

Success! After getting DHCP to work and finally remembering to enable NAT for the firewall policy, its works great. Now I just have to duplicate my policies to the new VDOM. I' m cautiously optimistic this will work well for my network. What I don' t know yet is how well the NAT will do under load compared to Transparent Mode. I' ll add my users in small groups and monitor the results. Thanks laf for your advice. After fumbling around blind it helps to be pointed in the right direction. Dave

[laf]

Ok, dvdsmith so everything is setup and works fine? Here s the NAT you could wish to do: http://kc.forticare.com/default.asp?id=2086&SID=&Lang=1 This way you get rid of another private class, you ll be need in Route/Nat Mode.

[dvdsmith]

Laf, If I understand the example in article correctly, all the interface IPs are statically assigned. I need WAN2 to get its IP via DHCP. As it is, it is working well and I happy with it. I have a dozen workstations using the second VDOM, and so far they haven' t had any problems, and I have yet to see any related increase in CPU usage. I' ll continue to add more in small groups. Thanks again for your help, Dave