same network on different vlans

[phillbl]

hi, we have a requirement to build some deployment vlans. users can then install images on servers within that vlan and the route through to the internet to do windows updates etc. the issue is that the servers go to sites and all sites are different businesses with our standard networking configured. each server ip address is 192.168.1.10 and the gateway is 192.168.1.1. This issue is that we need to build around 5 servers at the same time and it would be nice to not have to change the ip on 4 of the servers and they would be on the same vlan i understand that its not possible to add the same gateway\network multiple times on the firewall but i was wondering if i could some how create 4 vlans on the same port (virtual vlans) and then do some nat magic or something but to be honest not quite sire the best way to go about this. at the moment they put the servers on the same vlan and change the ip addresses but it would be nice not to do that. fortigate 90D but we are moving to a 200 soon. thanks

[ede_pfau]

hi, just to clarify: you have 5 servers on one wire and want to address them individually. I' d say you will have to give them 5 distinct IP addresses, regardless of the VLAN ID. How would you otherwise direct the return traffic to the individual server? You can use NAT to re-assign IP addresses to different subnets but the ' original' address has to be unique. The least amount of effort would be to assign distinct addresses from the same subnet, or use DHCP. You could even script the switch from DHCP to static IP address. And, before emnoc posts, who uses the 192.168.[0-2] subnets for real stuff??? This is asking for trouble later. Just my .02€.

[emnoc]

Agreed Static/DHCP address or even secondaries for if you are doing a temp move around would be my guess. You could configure secondaries for the final network the servers will be on, configure the 5 on the same wire and then redistribute them to their final positions in your LAN.

[phillbl]

hi, thanks for the replies. i think i forgot to add a part. the separated vlans are a staging area. all these servers go out to sites that are on their own private network behind a firewall/router. the are not part of our network, just a standard build we sell to the clients. this is why all the servers have the same ip addresses. so that when the servers are out on site, all our clients have a standard build to make trouble shooting easier. does that make sense? thanks

[ede_pfau]

I fully got your concept right from the start. Nonetheless, you cannot have 5 servers with the same IP address at the same time on your network. And again, using the first 192.168 subnets is calling for trouble. It might work for you for a while, until a VPN is needed or such. But you didn' t ask for layout hints, got it.

[emnoc]

How I worked this in one env, was with secondaries. We craft the new site LAN as secondary. Plugged the server up, configured with them with the correct netmask/gateway dns,etc.... and then all the build team had todo was shutdown and box the server up for UPS shipment to the new site. Once the stage and build was done, we just remove the secondary and repeat for the next new site and build with the next new block. Is that what your looking for or trying todo?

[netmin]

I know a lot of people doing strange network things for various reasons. So...not that I would do it this way or recommend it, but technically you can configure up to 10 independent VDOMs that can have VLAN interfaces on a common physical interface.

[emnoc]

But the problem with that, you can run out of ports very quickly and more so on a lower end model. So you have upto 14+ plus ports and how may ports does the client have on his switch that freed ? Seems like a lot of work if you ask me.

[netmin]

Hmmm - I would still only need one physical port on the LAN side. 1 root vdom that provides internet access up to 9 subordinate vdoms with inter-vdom links that nat outbound to the root vdom all subordinate vdom VLANs on one physical interface in the root vdom But as mentioned, I wouldn' t do this just for a ' nice to have'

[phillbl]

hi, thanks for all your replies, i did think of vdom but to be honest its not worth the complexity for such a simple task that engineers can do as a work around. i agree, if they need to build 5 servers at once they can change the ip on four and at the last minute change it back to what it needs to be. ede_pfau, im a bit confused as to why you say not to use the 192.168 subnets. most networks i have worked in use these. why would this be calling for trouble? again. thanks for all your help