AnsweredHot!Basic New Setup IP Question

Author
FirewallNoob
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/03/13 11:16:00
  • Status: offline
2017/04/18 12:39:46 (permalink)
0

Basic New Setup IP Question

Hello,
 
I am adding a new IP range to our WAN1 port and came across a weird issue/confusion on how the fgt is defining these fields in the GUI. I am probably overthinking it, but are we supposed to put in the full Assigned LAN Netblock address with /28 the IP assigns me in the fgt Network/Interfaces/edit WAN1 "IP/Netmask" field, or just the first LAN Usable IP (205.105.155.146/255.255.255.240 - or 255.255.255.255)?

Same goes for my static routes. The ISP gave me a Default Gateway for LAN Netblock to use - that should be my static route, correct? 0.0.0.0/0.0.0.0 as the IP/Mask and 205.105.155.145 for the Gateway under Router/Static/Static Routes?
 
Example of what we were provided, including explanation from ISP:
Assigned LAN Netblock  - 205.105.155.144/28
Subnet Mask: 255.255.255.240
LAN Usable IPs: 205.105.155.146 through 205.105.155.158
*You mas assign these IPs to your LAN (LAN Default Gateway, PC, Workstation, Firewall, etc)
Default Gateway for LAN Netblock: 205.105.155.145
*This will be the IP that all devices use as a default route or gateway for your LAN back to your router.
 
Config is ISP > 100Mbit managed Adtran router in bridged mode > WAN1 of FGT > flat HP network switch. No VLANs or anything.
 
Thanks!
post edited by FirewallNoob - 2017/04/18 12:41:12
#1
rwpatterson
Expert Member
  • Total Posts : 8016
  • Scores: 154
  • Reward points: 0
  • Joined: 2006/08/08 10:08:18
  • Location: Long Island, New York, USA
  • Status: online
Re: Basic New Setup IP Question 2017/04/18 18:35:41 (permalink) ☄ Helpfulby FirewallNoob 2017/04/18 18:39:30
0
You assign the interface a single address in the correct subnet. The other addresses in the range need to be assigned Virtual IP addresses (VIPs for short) from the Fortigate. The Fortigate will answer requests to these IPs and pass the traffic to the NATted device on the other side.

-Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

-4.3.18-b0689
FGT60B
FWF60B
FWF80CM (2)
FWF81CM
 
#2
FirewallNoob
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/03/13 11:16:00
  • Status: offline
Re: Basic New Setup IP Question 2017/04/18 18:43:48 (permalink)
0
Thank you RW, that seems clear. But, what should those numbers be in my example?
I am not a network engineer but noticed (we have two) fortigates..one uses the first addressable IP at the IP/Network mask and another uses the 3rd IP/Network mask. Furthermore, one uses an unusable Default gateway for a static route and another uses the last IP in the usable range?
 
What gives?
What is best practice?
 
Thank you for any help - these Fortigates are unconventional to me in terms of how they define these interfaces, wizards and help lookup. Cisco - no problem. Very clear. 
#3
neonbit
Gold Member
  • Total Posts : 361
  • Scores: 22
  • Reward points: 0
  • Joined: 2013/07/02 21:39:52
  • Location: Dark side of the moon
  • Status: offline
Re: Basic New Setup IP Question 2017/04/19 02:59:58 (permalink) ☼ Best Answerby FirewallNoob 2017/04/19 06:15:33
5 (1)
You would configure your wan1 interface with the address 205.105.155.146/28.
 
Your default gateway would be 0.0.0.0/0 and 205.105.155.145 as the gateway address.
#4
rwpatterson
Expert Member
  • Total Posts : 8016
  • Scores: 154
  • Reward points: 0
  • Joined: 2006/08/08 10:08:18
  • Location: Long Island, New York, USA
  • Status: online
Re: Basic New Setup IP Question 2017/04/19 05:54:33 (permalink) ☄ Helpfulby FirewallNoob 2017/04/19 06:15:39
5 (1)
neonbit
You would configure your wan1 interface with the address 205.105.155.146/28.
 
Your default gateway would be 0.0.0.0/0 and 205.105.155.145 as the gateway address.


More clearly, the IP address could be anything BUT 205.105.155.145 because that is the default gateway. The route should be 0.0.0.0/0. And the gateway IP is 205.105.155.145.

-Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

-4.3.18-b0689
FGT60B
FWF60B
FWF80CM (2)
FWF81CM
 
#5
FirewallNoob
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/03/13 11:16:00
  • Status: offline
Re: Basic New Setup IP Question 2017/04/19 06:15:27 (permalink)
0
Makes sense, thank you both for confirming. I'm not sure why these existing ones use something completely different. They are working fine, but it struck me as strange how they were configured.
#6
MikePruett
Platinum Member
  • Total Posts : 584
  • Scores: 8
  • Reward points: 0
  • Joined: 2014/01/08 19:39:40
  • Location: Montgomery, Al
  • Status: offline
Re: Basic New Setup IP Question 2017/04/19 06:32:10 (permalink)
0
What are the differences you are seeing?
 
Some ISPs will give you a /30 for your WAN interface and then route the usable addresses to that address. That is nice as it frees up address space you would have had to use otherwise for your WAN interface.

Mike Pruett
Fortinet GURU
#7
FirewallNoob
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/03/13 11:16:00
  • Status: offline
Re: Basic New Setup IP Question 2017/04/19 07:22:27 (permalink)
0
Aha - I found the original documentation from the ISP for FG1: 
 
FG#1:
from ISP:
"You have 13 static IPs 205.98.40.129-205.98.40.141 Gateway IP: 205.98.40.142"
WAN1 = 205.98.40.129/255.255.255.240
Static Route = 0.0.0.0/205.98.40.142
 
Ultimately, that is why it confused me. I assumed it was 205.98.40.128/255.255.255.240 and the gateway would then be 205.98.40.129, not .142...just like:
 
FG#2:
From ISP: 188.179.178.240/255.255.255.240
WAN1 = 188.179.178.242/255.255.255.240
Static Route = 0.0.0.0/188.179.178.241
 
The change in location of the gateway and WAN1 starting IPs are what tripped me up. ISP1 has the gateway at the end of the range and ISP 2 has it at the beginning. Instead of 14 usable IPs for ISP#1, they assigned 13 and just blocked out the rest of the range. I didn't realize this until i found the original documentation.
 
#8
Jump to:
© 2017 APG vNext Commercial Version 5.5