Virtual IP Confusion

[dblackwell]

I need help understanding this concept. Let's say my logical WAN address is 1.1.1.1 and I have a VIP of 1.1.1.2 assigned to a internal mail server. does the VIP address need to be assigned by my ISP? I just don't understand how I can use another outward facing address when my ISP is only giving me 1.1.1.1. Is this all done with NAT? So if it is just that (a virtual IP run over the physical 1.1.1.1 interface) then what is the point of doing this? Can I use any VIP I want? As you can see I quiet confused about this. The above is how my current exchange server is setup through a FortiGate 60D firewall and was when I took over for the company I work at.

[Toshi_Esumi]

In your example, both 1.1.1.1 and 1.1.1.2 need to be routable on the internet. Otherwise SMTP servers in the world can't send email to your email server with 1.1.1.2. If you don't have own ASN and advertise your subnet(s) over BGP to your ISP, additional IPs need to come from your ISP.

Then you can create an IP-pool with 1.1.1.2 and use it with your email server's outgoing policy to do SNAT. This part is described in below article (GUI method only though):

https://www.mirazon.com/h...ip-pools-in-fortigate/

[ede_pfau]

First, ping both 1.1.1.1 and 1.1.1.2 (the real IPs, I mean). If both are pingable you have proof that your ISP routes a subnet to your router and not a single address only.

It could be 1.1.1.1/29 for 6 public addresses, /30 is just enough for 2 addresses (the FGT and the ISP gateway).

After clarifying this we can look further how to make more than one internal server accessible from the 'net.

[siomyn]

Like ede_pfau said, we need to check the subnet IP that ISP give. If the ISP give you /30 (255.255.255.252), you just have 1 IP address assigned to your fortigate (another IP would be your gateway). If you need create VIP, you should use port-forwarding instead 1-to-1 nat.