same network on different vlans

[phillbl]

hi, we have a requirement to build some deployment vlans. users can then install images on servers within that vlan and the route through to the internet to do windows updates etc. the issue is that the servers go to sites and all sites are different businesses with our standard networking configured. each server ip address is 192.168.1.10 and the gateway is 192.168.1.1. This issue is that we need to build around 5 servers at the same time and it would be nice to not have to change the ip on 4 of the servers and they would be on the same vlan i understand that its not possible to add the same gateway\network multiple times on the firewall but i was wondering if i could some how create 4 vlans on the same port (virtual vlans) and then do some nat magic or something but to be honest not quite sire the best way to go about this. at the moment they put the servers on the same vlan and change the ip addresses but it would be nice not to do that. fortigate 90D but we are moving to a 200 soon. thanks

[emnoc]

ede_pfau, im a bit confused as to why you say not to use the 192.168 subnets. most networks i have worked in use these. why would this be calling for trouble?

I' m not edu_pfau , but you answered question with the statement you made in the above bold outline.The 192.168.0-2.0/24 is commonly used. So you will run into collisions sooner or later, as you build out. Most device default to this range also ( dlink, sonicwall, heck even fortinet ) so I typicall suggest to start way about that range like 192.168.100+.0/24 and the same for 10.0.0.0/8 or 172.16.0.0/12 If you proceed to use this range, than you sooner or later will be posting a question like the posting below this one about " double nat" , etc..... Try to avoid that range. Emnoc ROEs when using rfc1918 address; rule #1 maybe the netwokr bigger than you think you need.It isn' t like you have to justify usages to ARIN RIPE LATINIC or AFRINIC on why you used a /23 or smaller prefix rule#2 Avoid the low of whatever rfc1918 block since that the most common used blocks others or default blocks by SOHO/SMB devices

[ede_pfau]

Nicely put. We' ve seen several requests here when people used the default ranges in their networks, then the company expanded and suddenly they needed a VPN between sites with the same network addresses on both sides. One other example: in one of my customer' s network they used the 192.168.1 range (that was before my time :) One day, an employee brought in a Belkin NAS and connected it to a wall LAN socket. Worked immediately, only trouble was it offered addresses by DHCP (built-in server). That took quite some time to find out the reason for malfunctions with client PCs and then locate the device. You just don' t want devices to have internet (and/or internal) connectivity just by plugging it in.