@Paul Kuhne
On the Fortigate 800 you can add multiple IP addresses to an interface. This is done under the System -> Network -> Interface menu. Once you select the interface you wish to configure (probably External), look for the “Secondary IP Address” option. From there you add the needed IP addresses and choose to enable remote administration (HTTP/HTTPS) on one or more of the IP addresses. Note, this may not be available on the 80c.

Using different IPs based on the external service the workstation is attempting to use is a bit tricky. Most likely you will have to get creative with the firewall policies, however you may not be able to accomplish this with the 80c.

Next question (might not be the right thread for this). I have setup 4 blades into an ELBC cluster. I need to be able enable RIP. I had RIP working on the HA cluster, but when I changed it to the ELBC it got broken!!

Any suggestions.

Thanks

You will want to have a look at port forwarding as well as the one to many NAT feature. I have not played with these features, so I am unsure of they will accomplish your goal.

Have a look at my Fortigate NAT Overload (PAT) article. You can use the PAT address that is assigned to your external interface for any other traffic that does not need a dedicated IP (such as DNS forwarding).

Juts be sure you create a policy that allow DNS queries from your internal server to get to the external DNS servers that you are using. I use this method with our Fortigate and it works well.

Thanks for the easy to follow steps. I have just one question. How do I configure the VIP for traffic that is initiated inside the private network? DNS for example needs to forward to a server in another network on a natted address.

Thanks

My issue is that I am trying to get one WAN address to forward traffic to multiple LAN addresses..

So – 4.2.2.2 will have to ports open 80 and 25.. 80 needs to route to 192.168.0.5 and 25 needs to route to 192.168.0.10..

Thanks in advance..

Also, make sure your Fortigate has a route for the other IP range pointing out your external interface.

This seems to work fine if I use an ip that is on the same range as my external interface – however I have a need to NAT another range that is routed to my Fortigate by the ISP – and this seems to not work – any ideas ?

(for example if my external is 192.168.1.1/24, I need to NAT 192.168.2.1/24 – this 192.168.2.1/24 is routed to the 192.168.1.1 and I see the traffic hitting the external interface but it never gets forwarded to the inside)

Look forward to your comment.

Thanks in advance.

The screen shots used in both articles are from a Fortigate 800 using the “FGT_800-v400-build0099-FORTINET.out” image. From the time stamp of this file on Fortigate’s FTP site, this image was uploaded on April of 2009. So at the time I wrote this article, the firmware on the Fortigate was only 2 months old).

Thanks for reading my blog!

Get with the program will ya.

5 Years real world experienced, certified Fortigate Specialist.

Doc