Technical Tip: How to route/allow packets between 2 subnets on the same interface of a FortiGate (with one or more secondary IP addresses), hairpin policy or one-arm firewall
Description
This article describes how to configure a FortiGate to route/allow traffic between 2 (or more) subnets attached to the same interface of a FortiGate.
Scope
All FortiGates or VDOMs running in NAT/Route Mode.
Solution
- Subnet 10.1.1.0/24 <=====> (port1 FortiGate).
- Subnet 172.16.1.0/24 <=====> (port1).
Expectations, requirements:
Assume that subnet 10.1.1.0/24 is configured on port1, and 172.16.1.0/24 is configured as a secondary IP address of port1.
For this example, it is expected that all traffic flows from 10.1.1.0/24 to 172.16.1.0/24 and vice versa.
Configuration:
The following firewall policy will allow traffic between both subnets.
A policy from a port to the same port is sometimes also referred to as a hairpin policy (or one-arm firewall).
config firewall policy
edit 0
set srcintf "port1"
set dstintf "port1"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ANY"
next
To get finer control over the traffic flows in either direction, more than one hairpin policy may be needed, with specific IP source or destination IP addresses.
Troubleshooting:
For troubleshooting connectivity problems, see related articles about the sniffer and debug flow.
Note:
If the design requires same-interface forwarding without a policy match, enable these options manually.
Use with caution, as it bypasses the policy check for hairpin flows.
config system global
set allow-traffic-redirect enable
set ipv6-allow-traffic-redirect enable
end
During an upgrade to v7.4.10+ or v7.6.5+, these options are set to 'disable' as default settings even if they were previously enabled. This change in default behavior is detailed in FortiOS release notes,
- Policy check required for hairpin traffic | FortiGate / FortiOS 7.4.10 | Fortinet Document Library
- Policy check required for hairpin traffic | FortiGate / FortiOS 7.6.5 | Fortinet Document Library
With traffic-redirect disabled, same-interface forwarding is no longer permitted by routing decision alone. Therefore, it is likely that some traffic which was flowing implicitly over one-arm previously getting blocked after upgrade to v7.4.10+ or v7.6.5+. Traffic that enters and leaves through the same interface must now be required to match an explicit firewall policy to be allowed; otherwise, it will be blocked by implicit deny. To implicitly allow this traffic without the need for firewall policies as in previous versions, the allow-traffic-redirect and/or ipv6-allow-traffic-redirect settings can be kept enabled.
Related articles:
- Troubleshooting Tip: How to use the FortiGate sniffer and debug flow in presence of NP2 ports
- Troubleshooting Tool: Using the FortiOS built-in packet sniffer
- Troubleshooting Tip : First steps to troubleshoot connectivity problems to or through a FortiGate with sniffer, debug flow, session list, routing table
- How to allow traffic when using the same ... - Fortinet Community
