Technical Tip: How to match Firewall VIP objects using 'srcintf-filter' setting

Description

This article describes how to match Firewall VIP objects using the 'srcintf-filter' setting.

Scope

FortiGate v7.4.0 and above.

Solution

In some cases when the same external IP is used for different VIP objects, FortiGate can match the incorrect VIP from the incoming interface traffic perspective.

For example, the following VIPs were configured with the same external IP address but a different external Interface:

FGT100F # show firewall vip
    config firewall vip
        edit "VPN2_VIP"
            set extip 190.10.1.1 <-----
            set mappedip "10.11.18.15"
            set extintf "HUBVPN2"  <-----
        next
        edit "VPN1_VIP"
            set extip 190.10.1.1 < ---
            set mappedip "10.12.18.15"
            set extintf "HUBVPN1"
        next
     end        

Whenever the traffic is received on the firewall, during the DNAT lookup, firewall is not honoring the external interface configured in the VIP and just matching the VIP first in the lookup.

Because of this, the traffic is matching the incorrect policy. When the traffic is received from tunnel interface 'HUBVPN1', it is matching to the VIP object called 'VPN2_VIP' instead of the VIP 'VPN1_VIP'

FGT100F # 2025-10-15 19:30:56 id=65308 trace_id=26 func=print_pkt_detail line=5862 msg="vd-root:0 received a packet(proto=1, 172.16.10.11:4->190.10.1.1:2048) tun_id=11.15.6.24 from HUBVPN1. type=8, code=0, id=4, seq=0."
2025-10-15 19:30:56 id=65308 trace_id=26 func=init_ip_session_common line=6047 msg="allocate a new session-80154ad6"
2025-10-15 19:30:56 id=65308 trace_id=26 func=iprope_dnat_check line=5281 msg="in-[HUBVPN1], out-[]"
2025-10-15 19:30:56 id=65308 trace_id=26 func=iprope_dnat_tree_check line=824 msg="len=2"
2025-10-15 19:30:56 id=65308 trace_id=26 func=__iprope_check_one_dnat_policy line=5146 msg="checking gnum-100000 policy-1"
2025-10-15 19:30:56 id=65308 trace_id=26 func=get_new_addr line=1213 msg="find DNAT: IP-10.11.18.15, port-0(fixed port)"
2025-10-15 19:30:56 id=65308 trace_id=26 func=__iprope_check_one_dnat_policy line=5236 msg="matched policy-1, act=accept, vip=1, flag=104, sflag=2000018"
2025-10-15 19:30:56 id=65308 trace_id=26 func=iprope_dnat_check line=5293 msg="result: skb_flags-02000018, vid-1, ret-matched, act-accept, flag-00000104"
2025-10-15 19:30:56 id=65308 trace_id=26 func=fw_pre_route_handler line=184 msg="VIP-10.11.18.15:4, outdev-unknown"
2025-10-15 19:30:56 id=65308 trace_id=26 func=__ip_session_run_tuple line=3455 msg="DNAT 190.10.1.1:8->10.11.18.15:4"

This behavior is by design. To fix this, it is necessary to configure the option 'srcintf-filter' under each firewall VIP object to match the correct incoming interface.

• 'extintf' represents the external interface that the firewall policy source interface must match.

• 'srcintf-filter' restricts the interfaces that are allowed to use this VIP.

That is because 'extintf' does not prevent the VIP/DNAT from being checked and applied if traffic is received on a different interface.

To only have specific interfaces use the VIP object, 'srcintf-filter' should be used on the configuration.

For example:

FGT100F # show firewall vip
config firewall vip
    edit "VPN2_VIP" 
        set extip 190.10.1.1
        set mappedip "10.11.18.15"
        set extintf "HUBVPN2"
		set srcintf-filter "HUBVPN2"  < ---
    next
    edit "VPN1_VIP" 
        set extip 190.10.1.1
        set mappedip "10.12.18.15"
        set extintf "HUBVPN1"
		set srcintf-filter "HUBVPN1"   < ---
    next
end

After applying the srcintf-filter on each VIP, traffic started matching the correct VIP policy:

FGT100F # 2025-10-15 19:41:23 id=65308 trace_id=26 func=print_pkt_detail line=5862 msg="vd-root:0 received a packet(proto=1, 172.16.10.11:4->190.10.1.1:2048) tun_id=11.15.6.24 from HUBVPN1. type=8, code=0, id=4, seq=0."
2025-10-15 19:41:23 id=66517 trace_id=26 func=init_ip_session_common line=6047 msg="allocate a new session-60244a67"
2025-10-15 19:41:23 id=66517 trace_id=26 func=iprope_dnat_check line=5281 msg="in-[HUBVPN1], out-[]"

2025-10-15 19:41:23 id=66517 trace_id=26 func=iprope_dnat_tree_check line=824 msg="len=2"

2025-10-15 19:41:23 id=66517 trace_id=26 func=__iprope_check_one_dnat_policy line=5146 msg="checking gnum-100000 policy-2" < ---

2025-10-15 19:41:23 id=66517 trace_id=26 func=get_new_addr line=1213 msg="find DNAT: IP-10.12.18.15, port-0(fixed port)" < ---

2025-10-15 19:41:23 id=66517 trace_id=26 func=__iprope_check_one_dnat_policy line=5236 msg="matched policy-1, act=accept, vip=1, flag=104, sflag=2000018"

2025-10-15 19:41:23 id=66517 trace_id=26 func=iprope_dnat_check line=5293 msg="result: skb_flags-02000018, vid-1, ret-matched, act-accept, flag-00000104"

2025-10-15 19:41:23 id=66517 trace_id=26 func=fw_pre_route_handler line=184 msg="VIP-10.12.18.15:4, outdev-unknown"

2025-10-15 19:41:23 id=66517 trace_id=26 func=__ip_session_run_tuple line=3455 msg="DNAT 190.10.1.1:8->10.12.18.15:4"