Skip to main content
FortiS_T
FortiS_T
New Member
April 23, 2018
Solved

Access VIP from internal interface

  • April 23, 2018
  • 1 reply
  • 8186 views

Hi!

 

i have a fortiGate 100E with architecture like in this diagram:

 

i have a VIP that make snat from WAN1 (1.1.1.1) to server 10.0.0.1 and its working well from WAN.

guest network configured to go out via WAN2 interface, and i need to allow to guest users to access the server with the VIP address (1.1.1.1),

i tried to create a policy to allow connection from guest network to lan network via the VIP in destination and nothing,  i think there is any routing issue but i realy dont know what.

 

please your help,

Thanks!

 

 

 

Best answer by Sudarsan_Babu

Hello,

 

1. Check routing distance & Priority are same . 

2. Check Guest network routed through 10.0.0.0/24. 

 

 

 

1 reply

Sudarsan_Babu
Sudarsan_BabuAnswer
New Member
April 23, 2018

Hello,

 

1. Check routing distance & Priority are same . 

2. Check Guest network routed through 10.0.0.0/24. 

 

 

 

rwdorman
rwdorman
New Member
April 24, 2018

I've dont this for Internal networks accessing VIP's by doing an Internal -> Internal policy.  I would do a diag debug flow to check how routing and NAT are being applied.

rwpatterson
rwpatterson
New Member
April 24, 2018

Create a policy from WANx to internal, but make the source the INTERNAL subnet and the destination the Virtual IP, no NAT. See if that works. (Are you sure it is a source NAT? Virtual IP is a destination NAT) Years ago I had to 'hack' the infrastructure to do just this.

    Terms & ConditionsAccessibility statement