Virtual IP and secondary IP address

[deltasoft]

Hi all i have a Fortinet 60B 4.0MR1P9 with a /30 public ip subnet configured on wan1. Now i need to publish some servers connected to the DMZ interface with static nat 1-to-1, so i asked my provider to assign us a secondary subnet of 8 public ip addresses, different from the first one that was not possibile to extend. I' ve already configured on wan1 a secondary ip address using the first available ip of the new subnet. I' ve also configured the virtual ip rules and firewall rules to allow inbound traffic Now, do i need also a new static route pointing to the secondary ip of the gateway? If yes, what weight is needed? Do i need a policy route to force outgoing traffic from the virtual ip' s to the secondary gateway? Thanks in advance

[ede_pfau]

Hi, you can delete the secondary IP address, it' s not needed. The mechanism for 1:1 NAT is a VIP. The FGT will act on the external IP as if it was a physically assigned IP, that is it will proxy-arp for it. If you don' t use the port forwarding feature then not only reply traffic but even traffic originating at the internal server will have the VIP as the source IP. As your ISP takes care of the routing you don' t have to create a new static route / gateway.

[deltasoft]

So you' re saying that the only things i need are the vip definitions and the firewall rules? No secondary ip addresses, no static/policy routes at all, even if the new subnet is configured as " ip secondary" on the isp router (cisco)?

[ede_pfau]

Yes. The FGT will use the VIP and the WAN interface MAC as source for traffic from the internal host. The destination IP will be any, and traffic will be sent to the (now only) gateway. Of course, on that gateway the ISP has to have a route to your second subnet but that doesn' t matter to you. Perhaps you' ll feel more confident after a look at the documentation. I recommend the FortiOS Handbook for your version of FortiOS, available here: http://docs.fortinet.com

[deltasoft]

Prior i tried to search the documentation for " secondary ip" , but founding nothing of interest. Probably my search was not correct, could you point me to the correct section? Thanks

[ede_pfau]

See the doc ' fortigate-admin-40-mr2.pdf' (if you' re using v4.00MR2), chapter ' System Network' , subchapter ' Adding secondary IP addresses to an interface' . That was not too hard to find, was it? And even fearing that I repeat myself: secondary IP address is not the way to go. They should be avoided if possible as their use prevents the built-in anti-spoof protection. And in your case, you can only add 1 secondary IP address from the second range - how do you deploy the others then?

[deltasoft]

Ede, i' ve searched for " secondary ip" prior to open this topic, i was thinking it was the right way. Now, after your reply, it' s clear to me it was the wrong way. I was asking in what section of the user guide i can found informations about how to manage a secondary subnet as you explained. Tnx again

[ede_pfau]

From the Admin Guide (v4.00 MR2), chapter " Firewall Virtual IP" , pg. 312:

In addition to specifying IP address and port mappings between interfaces, virtual IP configurations can optionally bind an additional IP address or IP address range to the receiving network interface. By binding an additional IP address, you can configure a separate set of mappings that the FortiGate unit can apply to packets whose destination matches that bound IP address, rather than the IP address already configured for the network interface.

In other words, adding " bound" addresses is like having ' real' secondary addresses, except for that it includes a destination NAT which secondary IPs do not have.

[deltasoft]

Perfect, this is what i' m looking for. Thanks a lot