Explorer

Solved

2 VIP with same external IPs

Forum|Forum|2 years ago
April 29, 2024
9 replies
4126 views

I have an issue with VIPs on my FortiGate.

I have a single public IP address. I need to configure two different VIPs with this one public IP address, each using different services and pointing to different internal IPs. I created the two VIPs and used them in two different firewall policies. However, the problem I'm facing is that all traffic is going through just one firewall policy (the one with the first VIP created), even though the client-initiated traffic does not match that firewall policy.

Example:

196.209.90.89:80 -> 172.16.0.1:80
196.209.90.89:443 -> 172.16.0.1:443

196.209.90.89:22 -> 192.168.1.1:22
196.209.90.89:25 -> 192.168.1.1:25

Can you help me resolve this issue?"

FortiGate

Best answer by hbac

Hi @securitylearnercyber.,

Your VIPs don't have port forwarding enabled? It should look like below:

config firewall vip
edit "WebServer_VIP"
set extip 196.209.90.89
set mappedip "172.16.0.1"
set extintf "any"
set portforward enable
set extport 80
set mappedport 80
next
end

Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-port-forwarding-using-FortiGate-VIPs/ta-p/196734

Regards,

ozkanaltas

Valued Contributor III

Hello @securitylearnercyber ,

Is the port 22 the one you think is not working? If you say yes, can you check your Fortigate SSH port and SSH access on the wan interface?

Also, can you share this command output with us? After entering these commands, you should try to access your service.

diagnose sniffer packet any 'host <Your_WAN_IP> and port 22' 4 a

Second console screen :

diagnose debug disable

diagnose debug flow trace stop

diagnose debug flow filter clear

diagnose debug reset

diagnose debug flow filter daddr <Your_WAN_IP>

diagnose debug flow filter dport 22

diagnose debug flow trace start 100

diagnose debug enable

securitylearnercyberAuthor

Explorer

Hi @ozkanaltas

No, the problem is not SSH only.

Can't send capture of the configuration right now but i will try to explain it well:

VIP CONFIGURATIONS:

- VIP 1

config firewall vip 
     edit "OTHER_TRAFIC" 
          set service "FTP" "DNS" "PING"
          set extip 196.209.90.89 
          set extintf "any" 
          set mappedip "192.168.1.1" 
      next 
end

- VIP 2

config firewall vip     edit "WebServer_VIP"         set service "HTTP" "HTTPS"          set extip 196.209.90.89         set extintf "any"         set mappedip "172.16.0.1"     next end

FIREWALL POLICY CONFIGURATIONS:

- Firewall Policy 1

config firewall policy
    edit 1
        set srcintf "WAN"
        set dstintf "port1"
set srcaddr "all"
set dstaddr "OTHER_TRAFIC"
        set action accept
        set schedule "always"
set service "FTP" "DNS" "PING"
        set nat disable
    next
end

- Firewall Policy 2

config firewall policy
    edit 1
        set srcintf "WAN"
        set dstintf "port1"
set srcaddr "all"
set dstaddr "WebServer_VIP"
        set action accept
        set schedule "always"
set service "HTTP" "HTTPS"
        set nat disable
    next
end

After running diagnostics, all HTTP/HTTPS traffic is being redirected to Policy 1, even though these services are not specified in the firewall policy configuration. VIP 1, was the first one to be created.

ozkanaltas

Valued Contributor III

Hello @securitylearnercyber ,

I think the problem is the destination interface in the rule.

Your destination IP address is different in the VIP configuration but you selected the same destination interface in the policy.

Are you sure that you selected the right interface in the policy? if you don't use secondary IPs on the same interface, they need to be different.

AEK

SuperUser

If your 1st firewall policy is matching all the traffic that means your firewall policy has "ALL" as Service (destination port).

You should change it to just the required service, i.e.: HTTPS or SMTP, etc

AEK

securitylearnercyberAuthor

Explorer

Hi @AEK

This is not the problem.

Find below, the configurations i did:

VIP CONFIGURATIONS:

- VIP 1

config firewall vip 
     edit "OTHER_TRAFIC" 
          set service "FTP" "DNS" "PING"
          set extip 196.209.90.89 
          set extintf "any" 
          set mappedip "192.168.1.1" 
      next 
end

- VIP 2

config firewall vip     edit "WebServer_VIP"         set service "HTTP" "HTTPS"          set extip 196.209.90.89         set extintf "any"         set mappedip "172.16.0.1"     next end

FIREWALL POLICY CONFIGURATIONS:

- Firewall Policy 1

config firewall policy
    edit 1
        set srcintf "WAN"
        set dstintf "port1"
set srcaddr "all"
set dstaddr "OTHER_TRAFIC"
        set action accept
        set schedule "always"
set service "FTP" "DNS" "PING"
        set nat disable
    next
end

- Firewall Policy 2

config firewall policy
    edit 1
        set srcintf "WAN"
        set dstintf "port1"
set srcaddr "all"
set dstaddr "WebServer_VIP"
        set action accept
        set schedule "always"
set service "HTTP" "HTTPS"
        set nat disable
    next
end

After running diagnostics, all HTTP/HTTPS traffic is being redirected to Policy 1, even though these services are not specified in the firewall policy configuration. VIP 1, was the first one to be created.

hbacAnswer

Staff

Hi @securitylearnercyber.,

Your VIPs don't have port forwarding enabled? It should look like below:

config firewall vip
edit "WebServer_VIP"
set extip 196.209.90.89
set mappedip "172.16.0.1"
set extintf "any"
set portforward enable
set extport 80
set mappedport 80
next
end

Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-port-forwarding-using-FortiGate-VIPs/ta-p/196734

Regards,