Hot!Need help about reaching subnet

Author
serfasit
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/05/02 05:31:31
  • Status: offline
2019/07/18 03:57:00 (permalink)
0

Need help about reaching subnet

Hello,
 
I'am using FortiGate 60E device. All my network are in one vlan in subnet 192.168.1.x. I using 1 WAN port and 1 LAN port. 
Now i need more free IP so I need to reach for example subnet 192.168.2.x. What I need to do?
 
Thank you
#1

10 Replies Related Threads

    Dave Hall
    Expert Member
    • Total Posts : 1458
    • Scores: 160
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: Need help about reaching subent 2019/07/18 08:02:04 (permalink)
    0
    What exactly are you trying to do?  Are you trying to setup a separate lan (subnet) say on another physical port on the 60E?  Are you you running out of leased (DHCP) IP addresses for client devices? 

    NSE4/FMG-VM64/FortiAnalyzer-VM/5.4/6.0 (FWF40C/FW92D/FGT200D/FGT101E)/ FAP220B/221C
    #2
    lobstercreed
    Gold Member
    • Total Posts : 131
    • Scores: 21
    • Reward points: 0
    • Joined: 2018/11/28 14:57:58
    • Location: Sedalia, MO
    • Status: offline
    Re: Need help about reaching subent 2019/07/18 08:07:25 (permalink)
    0
    Based on the information you provided, I don't think you need *another* subnet so much as you need a *larger* subnet.  You could simply expand it to a /23 or /22 and leave your gateway at the same address.  Old DHCP or static clients would still reach the gateway but they might begin to have trouble reaching other clients in the expanded space until you updated their subnet mask (either via DHCP renewal or manually if they are static).
    #3
    rwpatterson
    Expert Member
    • Total Posts : 8404
    • Scores: 195
    • Reward points: 0
    • Joined: 2006/08/08 10:08:18
    • Location: Long Island, New York, USA
    • Status: offline
    Re: Need help about reaching subent 2019/07/18 08:30:02 (permalink)
    0
    lobstercreed
    Based on the information you provided, I don't think you need *another* subnet so much as you need a *larger* subnet.  You could simply expand it to a /23 or /22 and leave your gateway at the same address.  Old DHCP or static clients would still reach the gateway but they might begin to have trouble reaching other clients in the expanded space until you updated their subnet mask (either via DHCP renewal or manually if they are static).


    This approach would only work with prior planning being that there may not be free room in the 192.168.2.0/24 range.

    -Bob - self proclaimed posting junkie!
    See my Fortigate related scripts at: http://fortigate.camerabob.com

    -4.3.19-b0694
    FWF60B
    FWF80CM (4)
    FWF81CM (2)
     
    #4
    Dave Hall
    Expert Member
    • Total Posts : 1458
    • Scores: 160
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: Need help about reaching subent 2019/07/18 09:24:14 (permalink)
    0
    Depending on Marius's response, if he is running out of IP leases, I would suggest for a short term solution is to shorten the lease time to say 1-2 days. 
     

    NSE4/FMG-VM64/FortiAnalyzer-VM/5.4/6.0 (FWF40C/FW92D/FGT200D/FGT101E)/ FAP220B/221C
    #5
    serfasit
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/05/02 05:31:31
    • Status: offline
    Re: Need help about reaching subent 2019/07/18 09:56:49 (permalink)
    0
    I don't need separate lan, I will use the same LAN port on Fortigate. I only want for example move my camera's IP to 192.168.2.x subnet and I want access them from 192.168.1.x subnet. I use the same Fortiagate gateway 192.168.1.1.
    #6
    Dave Hall
    Expert Member
    • Total Posts : 1458
    • Scores: 160
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: Need help about reaching subnet 2019/07/18 10:34:50 (permalink)
    0
    Based on this requirement, perhaps bind a secondary IP (say 192.168.2.1) to the internal interface (that covers 192.168.1.x), which should be able to communicate with the camera IP on 192.168.2.x.   If you need to access this camera from outside (WAN) you could try a VIP (port forward) to the camera's IPs on the internal interface. 
     
    Alternately, and more likely more preferred if you do have VLANs setup on the internal interface is to create a second VLAN for 192.168.2.x), but the camera device will need to have VLAN support if you are using the same cable connection.  If not, you will need to either break up the internal interface members (say remove port7) and create a separate network using that port or use either DMZ or WAN2 if these ports are not currently used.
     
    serfasit
    I don't need separate lan, I will use the same LAN port on Fortigate. I only want for example move my camera's IP to 192.168.2.x subnet and I want access them from 192.168.1.x subnet. I use the same Fortiagate gateway 192.168.1.1.

    NSE4/FMG-VM64/FortiAnalyzer-VM/5.4/6.0 (FWF40C/FW92D/FGT200D/FGT101E)/ FAP220B/221C
    #7
    serfasit
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/05/02 05:31:31
    • Status: offline
    Re: Need help about reaching subnet 2019/07/18 22:02:48 (permalink)
    0
    Hello,
     
    I using fortigate only for Gateway (IP 192.168.1.1), I have AD server (192.168.1.2) with DHCP enable on it. And DHCH IP adresses are enough for me. 
    But I want move my hardware IP adresses (for example Ip cameras, printers and ect) to other subent example 192.168.2.x. 
    But then I configure my camera and added IP for example 192.168.2.2 I can't ping from my computer (for example computer IP 192.168.1.42 DHCP from my AD server). 
    What is the best way to reach subnet 192.168.2.x from my network?
    #8
    Dave Hall
    Expert Member
    • Total Posts : 1458
    • Scores: 160
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: Need help about reaching subnet 2019/07/19 10:22:43 (permalink)
    0
    The proper ideal way to separate your server, cameras, printers from your client devices is to place them on a separate cabled network (e.g. dividing up your switches and use at least two ports on the fgt device and a firewall policy for communicating between the two subnets or setup vlans.
     
    If you simply want to create an IP space separation between servers/printers/devices and still be able to have them communicate with the other devices you need to enlarge the IP scope and adjust the subnet mask accordingly. You basically keep the same default GW address, but change the net mask.
     
    Keep in mind that devices are only able to communicate with each other directly if they are detected on the same network (based on network/net mask) - otherwise communications is routed through the default gateway address. 
     
     

    NSE4/FMG-VM64/FortiAnalyzer-VM/5.4/6.0 (FWF40C/FW92D/FGT200D/FGT101E)/ FAP220B/221C
    #9
    serfasit
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/05/02 05:31:31
    • Status: offline
    Re: Need help about reaching subnet 2019/07/22 03:12:41 (permalink)
    0
    Hi,
    So all what I need to do is simple change Fortigate net mask?
    #10
    Dave Hall
    Expert Member
    • Total Posts : 1458
    • Scores: 160
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: Need help about reaching subnet 2019/07/22 09:23:26 (permalink)
    0
    Yes, but keep in mind you should be following the rules for subletting.  The min. net mask for 510 hosts network is /23 (net mask 255.255.254.0), which only works with certain IP ranges.  192.168.0.1 to 192.168.1.254 works, but not 192.168.1.1 to 192.168.2.254 (using that same net mask).  If you are adamant about using the 192.168.1.1 to 192.168.2.254 range, you need to go to /22 (net mask 255.255.252.0), which gives you 1022 hosts/net - the devices on your network will need to be using the same net mask as on the fgt.
     
    serfasit
    So all what I need to do is simple change Fortigate net mask?




    NSE4/FMG-VM64/FortiAnalyzer-VM/5.4/6.0 (FWF40C/FW92D/FGT200D/FGT101E)/ FAP220B/221C
    #11
    Jump to:
    © 2019 APG vNext Commercial Version 5.5