Technical Tip: Creation of a VIP (DNAT) when WANs are in SD-WAN on FortiGate

SD-WAN only determines the outgoing path; for incoming traffic, bind the VIP to the physical WAN(s), or use extintf any (not to the SD-WAN zone).

Option A: A single WAN (member of SD-WAN).

1. Policy & Objects -> Virtual IPs -> Create New.

• External IP/Range: The public IP.
• Mapped IP: Internal server IP.
• Port Forwarding (if applicable): extport <-> mappedport.
• Interface: Select the physical WAN that receives the traffic (not the SD-WAN zone).
  
  

2. Policy & Objects -> Firewall Policy -> Create New.

• Incoming interface: That WAN.
• Destination: The created VIP.
• Outgoing interface: LAN/DMZ of the server.
• Service: The published port(s).
• NAT: Disabled (it is DNAT).

Example: 

config firewall vip

    edit "vip_web_wan1"

        set extip 203.0.113.10

        set mappedip "10.10.10.10"

        set extintf "wan1"

        set portforward enable

        set extport 443

        set mappedport 443

    next

end

config firewall policy

    edit 100

        set name "in_web_wan1"

        set srcintf "wan1"

        set dstintf "lan"

        set srcaddr "all"

        set dstaddr "vip_web_wan1"

        set action accept

        set schedule "always"

        set service "HTTPS"

        set nat disable

    next

end

Option B: Two WANs.

Create a VIP for each WAN (each with its own public IP) and set up two identical policies by changing the Incoming interface and the Destination (VIP of WAN1 / VIP of WAN2). SD-WAN does not perform inbound load balancing; if it is required public high availability, utilize two DNS records (A/AAAA) with a low TTL or a failover mechanism in the DNS/ISP.

Example:

config firewall vip

    edit "vip_web_wan2"

        set extip 198.51.100.20

        set mappedip "10.10.10.10"

        set extintf "wan2"

        set portforward enable

        set extport 443

        set mappedport 443

    next

end

config firewall policy

    edit 101

        set name "in_web_wan2"

        set srcintf "wan2"

        set dstintf "lan"

        set srcaddr "all"

        set dstaddr "vip_web_wan2"

        set action accept

        set schedule "always"

        set service "HTTPS"

        set nat disable

    next

end

Notes:

• Do not use the SD-WAN zone as an interface in the VIP or as Incoming in the policy; use the physical WAN(s) instead. If the VIP stops working after enabling SD-WAN, it is often due to this or the response traffic going through the wrong WAN; check the SD-WAN rules/policy routes.
• If the public IP of the VIP is not configured on the interface but is within the same subnet (ISP /29 block), enable ARP Reply on the VIP so that the FortiGate can respond for that IP. Visit this KB article, Technical Tip: ARP reply setting in Virtual IP/IP Pool, for more information.
• Make sure that the policy uses the SD-WAN interface for incoming traffic, and verify the reverse-path checks are not blocking any traffic.
• If any of the WAN interfaces uses DHCP, it is recommended to create separate VIPs for each member instead of using the 'any' interface, as this does not efficiently support 0.0.0.0.
• Refer to this article for pros and cons: Technical Tip: Pros and Cons of using 'any' for Virtual IP Interface versus a specific interface.

Troubleshooting.

diagnose sniffer packet any 'host <public_IP> and port <port>' 4 0 l

• Check Forward Traffic logs to ensure the incoming policy (ID) is the one created.
• If there are no 'hits' on the VIP/Policy, check that the port is not in use by SSL-VPN/admin on that IP/port.

Related documents:

• Technical Tip: VIP not working with SD-WAN reply traffic causing issue
• Technical Tip: Configuring the external IP address of a virtual server with DHCP addressing mode
• config firewall vip
• VIP and SD-WAN
• Static virtual IPs