VLAN and Public IP

[fabioloc]

Good morning I need help for this scenario. At one of my clients I installed a fortigate 110c, connected to a router of our ISP. We have a range of 16 public static IP, I used some of these IPs to handle some services for my private network (10.0.0.0/24), no problems. Now their partners need to install a multimedia system. They need to have a private network different from the one you are using (for example, 192.168.20.0/24) with a dedicated static IP that can be used for access from the outside to their multimedia devices and a DHCP server on the private network. Under normal circumstances I would have bought a dedicated ADSL line (with a static IP), connected to a small router with a private LAN (for example, 192.168.17.0/24), dhcp enabled and I did get the ethernet cable that comes from one port of the router switch in their closet rack where they would then connected to their Cisco on which they write all the rules to operate their system. Instead of buying a new ADSL line separated, the customer asks me if we can use the internet connection already exists. So I thought of creating a VLAN. I found the tutorial on how to create vlan, firewall rules, the DHCP server for the VLAN. But it is the first time I do it, so I need to figure out how to handle a few things: 1) How can I assign to the VLAN a static IP of my ISP? 2) Physically, where do I connect the ethernet cable that will come along to Cisco' s main multimedia system? 3) I need to assign this VLAN to a switch port of the fortigate? Thanks to all and sorry for my english, I know it is not very good :-) Fabio

[fabioloc]

Add a note ... Maybe it' s better for my scenario, use the WAN2 instead of creating a VLAN? Thank you very much! Fabio

[emnoc]

You have a host of design 1: vlan or dedicate port for the 192.168.xx.xx network, fwpolicies only traffic from X to Y and use a static ippool for the traffic public-internet bound and VIP for any services that needs a VIP 2: dedicate a 2nd vdom, assign wan2 and portX or vlan-interface to that vdom and for that customer ( this would be most ideal if you want to share administration to the customer but yet control traffic, user and policies ), 3: A little of #2, but share the existing wan1 via vdom-interlink routing 4: buy a 2nd fortigate ;) ( joke )