Skip to main content
rajeev1963
rajeev1963
New Member
April 26, 2010
Question

DMZ Configuration

  • April 26, 2010
  • 6 replies
  • 5346 views
I am using Fortigate 100 A Wan1 : 110.234.200.XXX Internal : 192.168.1.0/24 ip: 192.168.0.1 DMZ: 10.10.10.0/24 ip: 10.10.10.1 and my Web Server ip: 10.10.10.2 I am not able to access http/https/ftp on webserver with wan1 ip. Please help me Rajeev Srivastava

    6 replies

    hidayet
    hidayet
    New Member
    April 26, 2010
    Hi rajeev1963, You' ve directed a webserver with port 80/443/21 VIP?
    rwpatterson
    rwpatterson
    New Member
    April 26, 2010
    To be a bit more explicit, you need to create a Virtual IP for each of these servers/services and use them as destinations in their respective policies.
    A
    Anonymous_User
    Contributor
    April 26, 2010
    I am thinking about also creating a DMZ to host a DMZ DNS server for RDNS on our set of IPs. Our ISP recently changed us to a full class C public address and they SWIP' d the IP block with ARIN in our name. I had asked them to create a PTR record for me but they said per ARIN' s allocation rules once you get a full class C the ISP basically becomes me and I' d have full control of what I do for DNS/PTR/RDNS etc. records. I get the gist of setting up the DMZ but I' m not sure how the policies should be setup to secure the DMZ DNS server as best I could...maybe only allow DNS service in the policies? Internal clients will not be using this DMZ DNS server at all. This is what I' m thinking: 1) WAN2 - public IP of 1.2.3.10 2) DMZ DNS server - DMZ IP of 172.16.105.10 (only node in this DMZ IP space) with GW set to 172.26.105.1 hooked up to port5 3) port 5 - DMZ IP of 172.26.105.1 4) create VIP (call it VIP1) for WAN2/1.2.3.10 mapped to 172.16.105.10 5) create policy for WAN2 ->port5 5a) source of all (0.0.0.0/0.0.0.0) -> VIP1, service of DNS 6) create policy for port5 -> WAN2 6a) source of DMZ DNS server 172.16.105.10 -> destination of all (0.0.0.0/0.0.0.0), service of ANY I could be WAAAYYY off but this is my best guess. Also, I' m not sure what service should be allowed on what policy. Would this work? If so how to secure it as best as I can? If this won' t work then edit my config above if you so kindly would. Thx in advance.
    rajeev1963
    rajeev1963Author
    New Member
    April 27, 2010
    Yes, I ve done VIP for port 80/443/21
    rwpatterson
    rwpatterson
    New Member
    April 27, 2010
    What services did you use in the policies? Built in or custom?
    rajeev1963
    rajeev1963Author
    New Member
    April 28, 2010
    I have used http/https/ftp. In 100A there is no built in. I have done Firewall -> VIP Name IP Service Port Map to IP/IP Range Map to Port ftp wan1/110.234.XXX.XXX 21/tcp 10.10.10.2 21/tcp web wan1/110.234.XXX.XXX 80/tcp 10.10.10.2 80/tcp web secure wan1/110.234.XXX.XXX 443/tcp 10.10.10.2 443/tcp Rajeev Srivastava
    rwpatterson
    rwpatterson
    New Member
    April 28, 2010
    ORIGINAL: rajeev1963 In 100A there is no built in.
    There are always built in services. They are under ' predefined' .
    claumakurumure
    claumakurumure
    New Member
    April 28, 2010
    Make sure in the firewall policy Wan1 => DMZ there is no NAT enabled sometimes this may be taken for granted
    rajeev1963
    rajeev1963Author
    New Member
    April 28, 2010
    I ve already done WAN1 -> DMZ in firewall policies
    claumakurumure
    claumakurumure
    New Member
    April 28, 2010
    Hi there, Sorry to bother you with silly questions Can you ping WAN1 from the internet? Do you have default route to the internet through Wan1? Is the route through wan1 appearing under Router =>Monitor? Do you have policy based routes for incoming traffic? I have noticed if the default gateway is wrong users can go out to the internet but you will not be able to get to the external interface from outside. If you cant ping Wan1 from outside clear that first. If you can ping then there could be firewal policy issues. Lastly you did not specify whether NAT is enabled or not for Wan1 => DMZ
    Terms & ConditionsAccessibility statement