Explorer II

Solved

Allow my customer to manage his VIP

Forum|Forum|2 years ago
May 30, 2024
16 replies
4676 views

Hello,

We are hosting a client on our infrastructure and have set up VDOMs as follows:

7c05a07157339373ac2647cbf55f0030_Topology_Inter VDOM Routing Ex_Internet access_Updated-01.png

We use FortiManager and have created an ADOM that contains the client's VDOM. The client can manage their firewall rules autonomously.

We have assigned them 10 public IPs and I would like them to be able to manage these autonomously as well. How should we proceed?

Thank you for your help!

Best answer by pminarik

Assuming root VDOM is under your control and VDOM1/2 under customer control, then in root you can simply route the 10 public IPs to the customer's VDOM, where they can deal with it however they like (VIP, IP pool, etc.)

pminarikAnswer

Staff

Assuming root VDOM is under your control and VDOM1/2 under customer control, then in root you can simply route the 10 public IPs to the customer's VDOM, where they can deal with it however they like (VIP, IP pool, etc.)

5q46n2te8jPWJYAuthor

Explorer II

Sorry but it doesn't work...

I created a route in my root VDOM to route my public IP (1.2.3.4) to my VDOM1.

config router static    edit 1       set dst 1.2.3.4 255.255.255.255       set gateway 10.0.0.2       set device "vlnk_VDOM1"    next end

and create a VIP

config firewall vip     edit "FTTO_SAMPLE_WEB_SERVICE_443"         set extip 1.2.3.4         set mappedip "192.168.1.1"         set extintf "vlnk_VDOM0"         set portforward enable         set extport 443         set mappedport 443     next

and create rules

config firewall policy     edit 69         set name "WAN to FTTO_SAMPLE_WEB_SERVICE_443"         set srcintf "vlnk_VDOM0"         set dstintf "VLAN_574"         set action accept         set srcaddr "all"         set dstaddr "FTTO_SAMPLE_WEB_SERVICE_443"          set schedule "always"         set service "HTTP" "HTTPS"     next end

Can you help me to find what is wrong ?

Toshi_Esumi

SuperUser

I would just disable the portforward and allow only ALL_ICMP in the policy to just test if routing is working fine with simple ping.
Your gateway IP is different from the diagram, which making me wonder if routing is working for the "1.2.3.4" IP.

Toshi

5q46n2te8jPWJYAuthor

Explorer II

Thank you, yes, I took the diagram in Fortigate's doc.

I disabled port forwarding, and enable ALL_ICMP, I can't ping my ressource from internet. In my network, ping is OK.

Here the full conf

Public IP: 1.2.3.4
Internal resource IP: 5.6.7.8

Inter vdom link :

config global config system vdom-link     edit "link_root_to_vdom1"     next end config vdom edit root config system interface     edit "link_root_to_vdom1"         set ip 192.168.1.1 255.255.255.252         set vdom "root"         set type vdom-link     next end  edit vdom1 config system interface     edit "link_root_to_vdom1"         set ip 192.168.1.2 255.255.255.252         set vdom "vdom1"         set type vdom-link     next end

Configure routing in root vdom

config vdom edit root config router static     edit 1         set dst 5.6.7.8 255.255.255.255         set gateway 192.168.1.2         set device "link_root_to_vdom1"     next end

Add static route in vdom1

config vdom edit vdom1 config router static     edit 1         set dst 0.0.0.0/0         set gateway 192.168.1.1         set device "link_root_to_vdom1"     next end

Create VIP in vdom1

config vdom edit vdom1 config firewall vip     edit "Public_to_Internal"         set extip 1.2.3.4         set mappedip 5.6.7.8         set extintf "link_root_to_vdom1"     next end

Configure security policy

config vdom edit vdom1 config firewall policy     edit 1         set srcintf "link_root_to_vdom1"         set dstintf "port2"         set srcaddr "all"         set dstaddr "Public_to_Internal"         set action accept         set schedule "always"         set service "ALL"         set nat enable     next end

pminarik

Staff

The static route in root is wrong. Root needs to be told how to route to the extip of the VIP in vdom1. (to be clear: it is wrong when talking about the VIP, it may be correct if you want root to talk to the destination's real IP 5.6.7.8 directly)

As always, debug flow and packet sniffer should help clarify what's going on.

5q46n2te8jPWJYAuthor

Explorer II

Sorry, I'm not sure I understand correctly. Above, you answered me :

Assuming root VDOM is under your control and VDOM1/2 under customer control, then in root you can simply route the 10 public IPs to the customer's VDOM, where they can deal with it however they like (VIP, IP pool, etc.)

I want my user to be able to use these IPs to create their VIPs. So this is why I try to created this static route. Can you guide me to the right way ?

I haven't IP Pool on root VDOM.

pminarik

Staff

Basic outline

assuming:

public IP of VIP: 1.2.3.4

local IP of the server: 9.8.7.6

root VDOM:

static route:

dst 1.2.3.4/32 via inter-vdom-link

firewall policy:

WAN->inter-vdom-link, allowing 1.2.3.4/32. (no SNAT)

vdom1:

VIP:

extip: 1.2.3.4

mappedip: 9.8.7.6

extintf: inter-vdom-link

firewall policy:

inter-vdom-link-> <interface towards 9.8.7.6>, dstaddr = the VIP. (no SNAT, typically)

static routes:

default route via inter-vdom-link

5q46n2te8jPWJYAuthor

Explorer II

Thank you for your help, but unfortunately, it still doesn't work. You mentioned SNAT in your response; my VDOMs do not have "Central SNAT" enabled. Could this be an issue?

On my VDOM1, I see incoming packet, but on my source device, ping don't work/

HOSTNAME (VDOM1) # diag sniffer packet any 'icmp and src host 92.184.99.183' 4
interfaces=[any]
filters=[icmp and src host 92.184.99.183]
30.048388 VLAN_301 in 92.184.99.183 -> 1.2.3.4: icmp: echo request

5q46n2te8jPWJYAuthor

Explorer II

I missed to tell you about sdwan is enable, maybe there is an impact ?

2024-06-13 12_27_32-FortiGate - HYP-ALL-SEC-FGCHG01 et 7 pages de plus - Travail – Microsoft Edge.png

In my log view, I see traffic incoming on interface. But in my rules, I can just check SDWan Zone, not interface. So traffic is blocked.

How can I do ?

pminarik

Staff

it looks like you don't have a matching firewall policy in the VDOM that owns VLAN_301 (is it root?).

You can run debug flow to check how it is evaluated:

diag debug flow filter clear

diag debug flow filter proto 1

diag debug flow addr <src-ip from which the ping comes>

diag debug enable

diag debug flow trace start 10

=> now try ping again

You can also show us the configuration of the policy you expect to be matched in root.

> my VDOMs do not have "Central SNAT" enabled. Could this be an issue?

Don't bother making changes to SNAT at this point, unless it proves to be required.

5q46n2te8jPWJYAuthor

Explorer II

Thank you again for your help

HOSTNAME (root) # id=65308 trace_id=4 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 92.184.99.180:36996->37.64.138.20:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=36996, seq=1." id=65308 trace_id=4 func=init_ip_session_common line=6127 msg="allocate a new session-00f5c4fb" id=65308 trace_id=4 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.2 via vlnk_HYP1" id=65308 trace_id=4 func=__iprope_tree_check line=535 msg="gnum-100004, use addr/intf hash, len=3" id=65308 trace_id=4 func=fw_forward_handler line=839 msg="Denied by forward policy check (policy 0)" id=65308 trace_id=5 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 92.184.99.180:50108->37.64.138.20:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=50108, seq=1." id=65308 trace_id=5 func=init_ip_session_common line=6127 msg="allocate a new session-00f5ca0e" id=65308 trace_id=5 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.2 via vlnk_HYP1" id=65308 trace_id=5 func=__iprope_tree_check line=535 msg="gnum-100004, use addr/intf hash, len=3" id=65308 trace_id=5 func=fw_forward_handler line=839 msg="Denied by forward policy check (policy 0)" id=65308 trace_id=6 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 92.184.99.180:26392->37.64.138.20:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=26392, seq=1." id=65308 trace_id=6 func=init_ip_session_common line=6127 msg="allocate a new session-00f5d200" id=65308 trace_id=6 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.2 via vlnk_HYP1" id=65308 trace_id=6 func=__iprope_tree_check line=535 msg="gnum-100004, use addr/intf hash, len=3" id=65308 trace_id=6 func=fw_forward_handler line=839 msg="Denied by forward policy check (policy 0)" id=65308 trace_id=7 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 92.184.99.180:42823->37.64.138.20:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=42823, seq=1."

2024-06-13 14_03_42-Paramètres.png