VLANs with public IP blocks assigned utilizing a single ISP

[purathal]

Hi All,

I am trying to setup a network like below and would like your help on how I can do this using a FortiSwitch (Layer 3).

Basically there is 1 uplink ISP connection that has /27 public IP allocated to it. I need to split that ISP provided /27 into multiple /29 blocks and assign each /29 block to a segregated VLAN.  Each VLAN must NOT communicate with each other for security reasons.  Essentially all VLANS are sharing the same uplink with their own block of /29.

For example:

ISP provided IP block: 66.x.x.x/27

I need to subnet the above to create two new /29 blocks (based on the above ISP provided /27 block).

1) ISP uplink is connected to physical port 1 of the FortiSwitch.

2) Create a first VLAN called CUSTOMERA and assign the first /29 IP block to it. This VLAN is bonded to physical port 2 of the FortiSwitch.

3) Create a second VLAN called CUSTOMERB and assign the second /29 block to it. This VLAN is bonded to physical port 3 of the FortiSwitch.

As you can see there are not NATing to private IPs. Each VLAN created also utilizes the public IP blocks. At the end all upstream VLAN traffic must utilize the same ISP upstream connection (gateway) to route its traffic to the Internet.  

Am I able to achieve the above on a FortiSwitch (layer 3)?Also, please provide an overview on how I can go about configuring the above setup.

Many thanks.

[purathal]

Anyone? 

Thank you!

[emnoc]

You should ask the ISP for a /30 or /31 and then route the /27 to you. Once you have done that you can carve the /27  up into /28 or /29s as required

Their's nothing you can do as-is. As far as each other /29 accesing the others /29s, a firewall or ACL is required.

Ken Felix