Skip to main content
AEK
SuperUser
AEK
SuperUser
May 22, 2024
Question

Duplicated VIP and VS is possible on FOS 7.2.8?

  • May 22, 2024
  • 1 reply
  • 1506 views

Hi FG admins

I have two FortiGates:

  • 2 physical FG with FOS 7.0.15 and FOS 6.2.x
  • 1 FG VM with FOS 7.2.8

On 7.0.15 and 6.2.x, when I try create two identical VIPs (same external IP and same port), it denies it and shows a red message:

"Conflicts with the External IP of another VIP"

Same for VS:
"Duplicate entry found"

So far all is fine and life is good.

 

But on my 7.2.8 it is doable and without any error message.

Duplicate VIP:

vip.png

Duplicate VS:

vs.png

 

Checked with CLI and I can see it is actually created.

Can someone reassure me that this is a known bug? Or is it a new feature on 7.2.x that I don't understand how it works?

1 reply

AEK
SuperUser
AEKAuthor
SuperUser
May 22, 2024

Ok it is a new feature on 7.2

768820  Remove overlap check for VIPs so there are no constraints when configuring multiple
        VIPs with the same external interface and IP. Instead, a new security rating report
        will alert users of any VIP overlaps.

But how does it work? Which VIP one will actually work? I guess not both, right?

AEK
Debbie_FTNT
Staff & Editor
Debbie_FTNT
Staff & Editor
May 23, 2024

Hey AEK,

as I understand it, the overlap check was removed because it caused issues for VIPs with same external IP/port, but different protocols (FortiGate wouldn't allow identical VIPs if one is for TCP, the other for UDP, for example).

As to what VIP is matched, this should depend on the firewall policies the VIPs are in - the firewall policies could be configured with source address filters, for example, so only specific traffic can match into a specific VIP. As long as a cloned VIP is not used, it doesn't do anything, and if you do add it to a policy, then it will simply translate the IPs if that policy is matched by incoming traffic.

 

Cheers,

Debbie

    AEK
    SuperUser
    AEKAuthor
    SuperUser
    May 23, 2024

    Thanks Debbie. It makes sense.. But I'll try perform more tests to understand the whole thing.

    AEK
      Terms & ConditionsAccessibility statement