adding secondary ip address

[#1]

i have a fortigate 60 at a remote property. The isp is assigning a new ip address on a different subnet on friday. I want to know if its possible to add the new ip address to the secondary ip address and set the routing metric different than what is on the primary by one value so it looks first at the old ip info then it moves to the new current ip info? Is this possible to do without losing connectivity to the remote site? that is can i configure a secondary ip address without losing connectivity? i dont have anything plugged into wan2 so i would assume that i would need to have it connected to the cable modem once the old ip info expires? sorry for the confusion, i inherited a whole bunch of these fortigates and am flying blind here as there is no documentation on them from the prev admin. any help is appreciated

[rwpatterson]

First off, welcome to the forums. Secondly, you seem to have two different scenarios confused. If you add a secondary IP to an interface (wan1), then there is no need to look at a second interface (wan2). The Fotigate (FGT) will respond to both IP addresses on the same physical interface. I believe this can be done wihout dropping connectivity. Also the routing can be done as you suggest, but if you set the metrics the same, the secondary IP will not respond until the new ISP IP address is up. So there should be no issues. Also, if you leave out that second route until you' re sure the pipe is good, you have less complications in the way for an already functioning device. Now if the second IP address is on a second interface, then yes you could do as you suggested, but leave the metrics the same and change the routing priority. Both routes will be hot, but the FGT will use the higher priority route as long as it is up. Let us know which scenario applies, and we' ll move on from there.

[#3]

no the second ip is on the primary interface, the isp is replacing our old ip addressing with new ip addressing on a diff subnet. what about dns for the secondary ip address? the primary pipe is going to go dead at midnight and our vpn tunnel is going to fail so i need the route to the outside in there before they cut us off. I am having to do this remotely and dont know what the skill set is of the people on site so i dont want to sit on the phone trying to troubleshoot. as long as i can get to it, then i should be fine i just want to make sure i keep it up when the old ip gets killed.

[rwpatterson]

For the dual route option, DNS is only a problem for the devices inside the firewall, not for the FGT itself. Your virtual IP definitions (web, mail, ftp, etc.) and DNS for the outside world should be changed prior to that date... If there is going to be any overlap at all, you can test the connection with a policy route. Good luck