Configuring VIP (DNAT) in Transparent mode

Forum|Forum|16 years ago
March 16, 2010
7 replies
5641 views

I took the following sample from tranparent mode technical guide. I used wan ip address for extip with service RDP. I am trying to establish rdp session from any wan address. I also set mappedip to the machine on internal lan with local ip. I am not able to establish rdp session with extip. Would anyone know what could be the problem? BTW.. It appears that not everything you could do from GUI and GUI is not able to show the entire configuration much like cisco. config firewall vip edit " vip1" set extip 192.168.183.48 set extintf " vlan160_p2" set mappedip 192.168.182.78 next end config firewall policy edit 4 set srcintf " vlan160_p2" set dstintf " vlan18_p3" set srcaddr " all" set dstaddr " vip1" set action accept set schedule " always" set service " ANY" next end

Carl_Wallmark

New Member

In transparent mode, you cant do VIP just like that, transparent dont route, however, there is a workaround, using the managament IP, then you can do a VIP. Never done it myself but i have read about it.

Roman_GelfandAuthor

New Member

I am really lost now. Why is fortinet publishing documents claiming things that you can do but in reality you can' t.

Carl_Wallmark

New Member

Are you sure they didnt mention management ip ? in transparent mode, the FG acts like a switch, not a router. BIG differens ;) can you post a link to the documentation (also page) ?

Roman_GelfandAuthor

New Member

The link is... http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FortigateTransparentModeTechnicalGuideFortiOS40v10pdf&sliceId=&docTypeID=DT_PRODUCTDOCUMENTATION_1_1&dialogID=4324921&stateId=0%200%204326901 If you could decipher this for me, I would greatly appreciate it. Thanks for your help.

Carl_Wallmark

New Member

If you look under the example picture, it says: -------------------------- Note : if the mappedip is on a different subnet than the management IP, the Fortigate must have a valid route to this destination --------------------------- and like i said before there is a way to route in transparent mode, but you have to use your " management ip" for the external ip.

Roman_GelfandAuthor

New Member

k.. is there an issue with using management ip as an external ip?

Carl_Wallmark

New Member

yes and no, your management ip is your way to access the FG via http/https/telnet etc.. be sure to only allow the traffic you want for remote management

Sign up

Login with SSO

Login to the community

Login with SSO