Planning the network topology
How to set up your FortiWAN
This is the reason FortiWAN separates WAN link configuration into different type: routing mode and bridge mode (See
"
WAN types: Routing mode and Bridge mode
"). If you configure a bridge-mode WAN link that ISP provides on
FortiWAN as Routing Mode and the bridge-mode WAN link might belong to a shared class C subnet, FortiWAN treats
the whole class C network as near WAN, traffic goes to or comes from the class C network would be ignored for
FortiWAN’s balancing, management and statistics functions. That would be a big mistake.
See also
WAN types: Routing mode and Bridge mode
Public IP pass through (DMZ Transparent Mode)
Public IP Pass through makes the physical Ethernet segments connected to WAN port and DMZ port become one
logical segment, which is implemented by Proxy ARP (for IPv4) and ND Proxy (for IPv6). Therefore, one IP subnetwork
can be deployed over the two segments and accessibility between WAN and DMZ is the action taken without NAT or
routing. Note public IP pass through is available when a WAN link is configured as Routing mode with the deployment
of subnet in WAN and DMZ, or Bridge mode: multiple static IP with IP addresses being deployed in WAN and DMZ.
For the WAN link that ISP provides multiple static IP addresses (no matter routing mode or bridge mode), it’s very
convenient to deploy some public IP addresses in DMZ for external-facing services.
In the topology below, the PC in DMZ has been assigned with a public IP 211.21.38.43, in the same IP range with
port1. Public IP Pass-through actually indicates port4 has been transparently connected to port1 (shown in dotted line).
Thus, the PC in DMZ takes port1's gateway as its own gateway.
Public IP Pass-through minimizes the adaptation to current network structure and requires no changes on the
configuration for servers while a FortiWAN is deployed into.
FortiWAN Handbook
Fortinet Technologies Inc.
25
