Technical Tip: Changing the HTTPS administrative port of Firewall GUI to avoid conflict when using a VIP with same external IP address as the FortiGate
Description
This article describes a precaution to take when configuring VIP (Virtual IP) with the same external IP address and port as the FortiGate HTTPS administrative port, and no port forwarding is set.
Scope
FortiGate.
Solution
External IP :
a.b.c.d.
[ Internet ] === { FortiGate } === WEB server.
[ Internet ] === { FortiGate } === WEB server.
VIP --> a.b.c.d to the WEB server.
No port forwarding set.
No port forwarding set.
In this situation, when accessing http://a.b.c.d or https://a.b.c.d, the FortiGate would forward all the traffic to the WEB server, and HTTPS administration access to the FortiGate itself will be impossible.
The problem is the conflict between the VIP and the FortiGate administrative access port.
This can be resolved by first changing and releasing the default HTTPS ports used by the FortiGate, and then, by configuring Port Forwarding on the VIP.
Step 1: Changing the administration ports from the GUI :
Navigate to System -> Settings -> Administration Settings, and change the port numbers, as shown below :
Navigate to System -> Settings -> Administration Settings, and change the port numbers, as shown below :
From CLI :
config system global
set admin-sport 1443
end
set admin-sport 1443
end
Step 2: Configuring port forwarding on the VIP :
Navigate to Policy & Objects -> Virtual IPs, and edit the VIP to add port forwarding:
From CLI:
config firewall vip
edit "VIP_port3"
set portforward enable
set extport 443
set mappedport 443
next
end
edit "VIP_port3"
set portforward enable
set extport 443
set mappedport 443
next
end
