Fortinet black logo

Handbook

IPv4 pools

6.0.0
Copy Link
Copy Doc ID 4afb0436-a998-11e9-81a4-00505692583a:476781
Download PDF

IPv4 pools

  1. Go to Policy & Objects > IP Pools.
  2. Select Create New.
  3. In the IP Pool Type field choose IPv4 Pool
  4. Enter a name in the Name field for the new service
  5. Include any description you would like in the Comments field
  6. In the Type field choose between:
    • Overload
    • One-to-One
    • Fixed Port Range
    • Port Block Allocation

At this point the configurations can start to differ based on the type of type of pool.

For more information on the different types of IP pools, check IP pools in the Concepts section.

Overload

  1. For the External IP Range fields, enter the lowest and highest addresses in the range. If you only want a single address used, enter the same address in both fields.
  2. Enable the ARP Reply field by making sure there is a check in the box
  3. Select OK
Overload example for GUI

In this example, the Sales team needs to connect to an Application Service Provider that does the accounting for the company. As a security measure, the ASP only accepts traffic from an allowlist of IP addresses. There is 1 public IP address of the company on that list.The Sales team consists of 40 people, so they need to share.The external interface is wan1.

Field Value
IP Pool Type IPv4 Pool
Name Sales_Team
Comments For the Sales team to use to connect to the Accounting ASP
Type Overload (This is the default)
External IP Range 10.23.56.20 - 10.23.56.20
ARP Reply enabled
Overload example for CLI

config firewall ippool

edit Sales_Team

set comments "For the Sales team to use to connect to the Accounting ASP"

set type overload

set startip 10.23.56.20

set endip 10.23.56.20

set arp-reply enable

set arp-intf wan1

end

One-to-one

  1. For the External IP Range fields, enter the lowest and highest addresses in the range. If you only want a single address used, enter the same address in both fields.
  2. Enable the ARP Reply field by making sure there is a check in the box.
  3. Select OK
One-to-one example for GUI

In this example, the external IP address of the mail server is part of a range assigned to the company but not the one that is assigned to the Internet facing interface. A VIP has been set up but in order to properly resolve Reverse DNS lookups the mail server always has to use a specific IP address.The external interface is wan1.

Field Value
IP Pool Type IPv4 Pool
Name Mail-Server
Comments So the correct IP address is resolved on Reverse DNS look ups of the mail server.
Type One-to-one
External IP Range 10.23.56.21 - 10.23.56.21
ARP Reply enabled
One-to-one example for CLI

config firewall ippool

edit Mail-Server

set comments "So the the correct IP address is resolved on reverse DNS look ups of the mail server."

set type one-to-one

set startip 10.23.56.21

set endip 10.23.56.21

set arp-reply enable

set arp-intf wan1

end

Fixed port range

  1. For the External IP Range fields, enter the lowest and highest addresses in the range. If you only want a single address used, enter the same address in both fields.
  2. Fort the Internal IP Range fields, enter the lowest and highest addresses in the range.
  3. Enable the ARP Reply field by making sure there is a check in the box
  4. Select OK
Fixed port range example for GUI

In this example, the company has a range of 10 IP address that they want to be used by employees on a specific subnet for NATing.The external interface is wan1.

Field Value
IP Pool Type IPv4 Pool
Name IPPool-3
Comments IP range to be used by outgoing traffic
Type Fixed Port Range
External IP Range 10.23.56.22 - 10.23.56.31
Internal IP Range 192.168.23.1 - 192.168.23.254
ARP Reply enabled
Fixed port range example for CLI

config firewall ippool

edit IPPool-3

set comments "So the the correct IP address is resolved on reverse DNS look ups of the mail server."

set type fixed-port-range

set startip 10.23.56.22

set endip 10.23.56.31

set source-startip 192.168.23.1

set source-endip 192.168.23.254

set arp-reply enable

set arp-intf wan1

end

Port block allocation

  1. For the External IP Range fields, enter the lowest and highest addresses in the range. If you only want a single address used, enter the same address in both fields.
  2. In the Block Size field, either type in the value or use the up or down arrows to set the value of the block size.
  3. In the Blocks Per User field, either type in the value or use the up or down arrows to set the value for the number of blocks per user.
  4. Enable the ARP Reply field by making sure there is a check in the box
  5. Select OK
Port block allocation timeout

The port block allocation timeout value is configurable. The setting is found in the CLI.

The option pba-timeout has been added to the firewall ip pool configuration. The availability of this option is dependent on the type option being set to port-block-allocation. The timeout value is measured in seconds and is an integer between 3 and 300, with the default being 30.

Syntax:

config firewall ippool

edit <name of PBA pool>

set type port-block-allocation

set pba-timeout <integer>

end

Port block allocation example for GUI

In this example, an small ISP is setting up NATing for its clients, but to be fair it is putting some restrictions on the number of connections each client can have so that no one hogs all of the possible ports and addresses.The external interface is port12.

Field Value
IP Pool Type IPv4 Pool
Name Client-IPPool
Comments IP Pool for clients to access the Internet
Type Port Block Allocation
External IP Range 10.23.75.5 - 10.23.75.200
Block Size 64
Blocks Per User 8
ARP Reply enabled
Port block allocation example for CLI

config firewall ippool

edit Client-IPPool

set comments "IP Pool for clients to access the Internet"

set type port-block-allocation

set startip 10.23.75.5

set endip 10.23.75.200

set block-size 64

set num-blocks-per-user 8

set permit-any-host disable

set arp-intf wan1

set arp-reply enableset

arp-intf port12

end

IPv4 pools

  1. Go to Policy & Objects > IP Pools.
  2. Select Create New.
  3. In the IP Pool Type field choose IPv4 Pool
  4. Enter a name in the Name field for the new service
  5. Include any description you would like in the Comments field
  6. In the Type field choose between:
    • Overload
    • One-to-One
    • Fixed Port Range
    • Port Block Allocation

At this point the configurations can start to differ based on the type of type of pool.

For more information on the different types of IP pools, check IP pools in the Concepts section.

Overload

  1. For the External IP Range fields, enter the lowest and highest addresses in the range. If you only want a single address used, enter the same address in both fields.
  2. Enable the ARP Reply field by making sure there is a check in the box
  3. Select OK
Overload example for GUI

In this example, the Sales team needs to connect to an Application Service Provider that does the accounting for the company. As a security measure, the ASP only accepts traffic from an allowlist of IP addresses. There is 1 public IP address of the company on that list.The Sales team consists of 40 people, so they need to share.The external interface is wan1.

Field Value
IP Pool Type IPv4 Pool
Name Sales_Team
Comments For the Sales team to use to connect to the Accounting ASP
Type Overload (This is the default)
External IP Range 10.23.56.20 - 10.23.56.20
ARP Reply enabled
Overload example for CLI

config firewall ippool

edit Sales_Team

set comments "For the Sales team to use to connect to the Accounting ASP"

set type overload

set startip 10.23.56.20

set endip 10.23.56.20

set arp-reply enable

set arp-intf wan1

end

One-to-one

  1. For the External IP Range fields, enter the lowest and highest addresses in the range. If you only want a single address used, enter the same address in both fields.
  2. Enable the ARP Reply field by making sure there is a check in the box.
  3. Select OK
One-to-one example for GUI

In this example, the external IP address of the mail server is part of a range assigned to the company but not the one that is assigned to the Internet facing interface. A VIP has been set up but in order to properly resolve Reverse DNS lookups the mail server always has to use a specific IP address.The external interface is wan1.

Field Value
IP Pool Type IPv4 Pool
Name Mail-Server
Comments So the correct IP address is resolved on Reverse DNS look ups of the mail server.
Type One-to-one
External IP Range 10.23.56.21 - 10.23.56.21
ARP Reply enabled
One-to-one example for CLI

config firewall ippool

edit Mail-Server

set comments "So the the correct IP address is resolved on reverse DNS look ups of the mail server."

set type one-to-one

set startip 10.23.56.21

set endip 10.23.56.21

set arp-reply enable

set arp-intf wan1

end

Fixed port range

  1. For the External IP Range fields, enter the lowest and highest addresses in the range. If you only want a single address used, enter the same address in both fields.
  2. Fort the Internal IP Range fields, enter the lowest and highest addresses in the range.
  3. Enable the ARP Reply field by making sure there is a check in the box
  4. Select OK
Fixed port range example for GUI

In this example, the company has a range of 10 IP address that they want to be used by employees on a specific subnet for NATing.The external interface is wan1.

Field Value
IP Pool Type IPv4 Pool
Name IPPool-3
Comments IP range to be used by outgoing traffic
Type Fixed Port Range
External IP Range 10.23.56.22 - 10.23.56.31
Internal IP Range 192.168.23.1 - 192.168.23.254
ARP Reply enabled
Fixed port range example for CLI

config firewall ippool

edit IPPool-3

set comments "So the the correct IP address is resolved on reverse DNS look ups of the mail server."

set type fixed-port-range

set startip 10.23.56.22

set endip 10.23.56.31

set source-startip 192.168.23.1

set source-endip 192.168.23.254

set arp-reply enable

set arp-intf wan1

end

Port block allocation

  1. For the External IP Range fields, enter the lowest and highest addresses in the range. If you only want a single address used, enter the same address in both fields.
  2. In the Block Size field, either type in the value or use the up or down arrows to set the value of the block size.
  3. In the Blocks Per User field, either type in the value or use the up or down arrows to set the value for the number of blocks per user.
  4. Enable the ARP Reply field by making sure there is a check in the box
  5. Select OK
Port block allocation timeout

The port block allocation timeout value is configurable. The setting is found in the CLI.

The option pba-timeout has been added to the firewall ip pool configuration. The availability of this option is dependent on the type option being set to port-block-allocation. The timeout value is measured in seconds and is an integer between 3 and 300, with the default being 30.

Syntax:

config firewall ippool

edit <name of PBA pool>

set type port-block-allocation

set pba-timeout <integer>

end

Port block allocation example for GUI

In this example, an small ISP is setting up NATing for its clients, but to be fair it is putting some restrictions on the number of connections each client can have so that no one hogs all of the possible ports and addresses.The external interface is port12.

Field Value
IP Pool Type IPv4 Pool
Name Client-IPPool
Comments IP Pool for clients to access the Internet
Type Port Block Allocation
External IP Range 10.23.75.5 - 10.23.75.200
Block Size 64
Blocks Per User 8
ARP Reply enabled
Port block allocation example for CLI

config firewall ippool

edit Client-IPPool

set comments "IP Pool for clients to access the Internet"

set type port-block-allocation

set startip 10.23.75.5

set endip 10.23.75.200

set block-size 64

set num-blocks-per-user 8

set permit-any-host disable

set arp-intf wan1

set arp-reply enableset

arp-intf port12

end