fortiextender 40d local nat mode config

[londonnet]

Hi, I have a fex-40d which I would like to use to provide primary internet access for a remote fortigate 60d

I initially configured the fex-40d to local mode, passthrough. This worked for a few weeks but then stopped working and I had to do a sim swap before the lte conection came live again. I am able to connect my laptop to the ethernet interface, I get a passthough dhcp address and I get access tot he intenet.

However, when I connect it the fortigate 60d I have not internet access. The passthough adress is obtained by the 60d but no internet access. Change it back to my laptop and I can access the internet.

What is happening to the 60d that stops internet access (it used to work and does on a fortigate 60e)

Is there some blocking going on the 60d?

As an alternative config, I'd like to use the fex-40d in local NAT mode so I can still access the management interface of the fex. Does anyone have a good config for this as an example?

I set the management to local and nat and on my laptop I manually set my IP and default gateway , dns. but  I do not get internet access. Do I need to configure a route or a policy?

I would alos like for the ethernet interface to serve up dhcp but when I configure the interface, I lose all conectivity and I have to factory reset the device again 

In short. I'd like to understand why when I connect the fex to a fortigate 60d in bridge mode, why on this unit do I not get internet access?

Or what is the config steps to configure local managed NAT with a dhcp server.

I think my quickest solution is to understand why the 60d can't connect to the internet when the fex is in bridging mode. The 60D's wan1 interface should just route out over the internet but something is blocking that

This unit is running ver 4.1

Thanks

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[atakannatak]

Hi @londonnet ,

Let's summarize the questions:

1-Why the FortiGate-60D loses Internet in bridge (passthrough) mode

When you swap SIM cards or factory-reset a FortiExtender, the LTE ISP often assigns a new CGNAT address and sometimes a different gateway MAC. A laptop refreshes its DHCP lease and ARP table instantly, but the FortiGate can keep the old ARP entry for up to five minutes. During that interval, the FortiGate 60D sends traffic to a stale MAC address, resulting in lost internet connectivity. After the FortiGate receives a new passthrough IP, run execute clear system arp table (or simply bounce the WAN interface) to restore service immediately.

2-Run the FEX-40D in Local-NAT mode

With this approach, the extender always responds with its own gateway IP, preserving GUI access and avoiding passthrough quirks. In Local NAT—also called Router mode—the FortiExtender behaves like a typical ISP router:

Laptop ──► FortiGate WAN ───192.168.99.x/24 (LAN0) ─── FortiExtender 40D ──► LTE WAN (modem interface)

• LAN0 hands out DHCP (192.168.99.10-.100) and acts as default-gateway 192.168.99.1.
• FortiExtender source-NATs everything to its LTE address.
• You can still browse to https://192.168.99.1 for modem stats.

In Local-NAT mode, the FortiExtender masks LTE MAC changes, preventing ARP quirks or passthrough issues from disrupting the FortiGate 60D, which simply sees a standard broadband router upstream.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

[londonnet]

I very much appreciate the response, but here is what is happening.

First of all the outage, loss of internet access was resolved by performing a sim swap with the telco, not sure if the telco is blocking the fortiextender or if the sim was just failty. I will see if this happens again but when it goes down the only thing that brings service back is a sim swap.

Second, when I enable NAT mode and configure dhcp on the fortiextender it just makes it in accessible, and I have to factory reset it just to gain access again. It's really this issue I am struggling to fix. Does anyone have any screenshots of a working config for nat mode?