Skip to main content
sethadrian
sethadrian
New Member
May 18, 2016
Question

Configuring ISP2 for 1-to-1 nat web server only

  • May 18, 2016
  • 1 reply
  • 6041 views

Hi,

 

I was wondering if its possible to set up a 1-to-1 NAT for a webserver purpose only?  Currently the office firewall is configured to route all traffic going to the internet on ISP1(port1).  Then decided to add a secondary ISP connection just for the web server access only.  Is there a need to create static routes and policy routes for this?  please help.

 

Thank you

1 reply

NotMine
NotMine
Explorer III
May 18, 2016

I would probably add one more default static route thru the second ISP connection, which would have the same priority, but a larger distance than a primary default route. That way both default routes will be in the routing table, but only the first one will be normally used. Then, create a VIP (virtual IP) to achieve a 1-to-1 NAT for you Web server. If you need your Web server to initiate connections to the Internet for any reason, than you'll probably also need to add a policy route for it to use the second ISP as a default route.

 

This is just my idea of a solution, maybe someone else will have different ideas.

 

Cheers!

Slavko

sethadrian
sethadrianAuthor
New Member
May 19, 2016

HI Slavko,

 

Thank you for the reply.  I actually tried your suggestion.  The problem is the External IP of ISP2 is no longer reachable since the distance is now higher that ISP1 to which it is normal since the configuration now is set to active-passive.  Since ISP1 is live all returning traffic will redirect to ISP1 so ping results would end up RTO.  Now If i put a policy route.  behavior of traffic changes like for example a vlan will not be able to reach the DMZ zone and it would think that DMZ is reachable via ISP2 to which when it return will not be able to ping the servers inside DMZ zone.  FYI: DMZ servers are different to the servers im trying to port map.  Any suggestions on this?

 

Thanks

seth

neoashwin
neoashwin
New Member
May 19, 2016

We have a Fortigate 90D, an external physical link from a Tomcat Server is connected but unable to access when pass through the firewall. It works fine with the older Juniper. Please help.

Terms & ConditionsAccessibility statement