Skip to main content
Jaures
Jaures
New Member
February 26, 2015
Question

Firewall policies with DMZ interface

  • February 26, 2015
  • 3 replies
  • 21644 views

Hello all,

I have a fortigate behind an edge router. The edge router is doing NAT for internal servers and internal users.

Internal servers are connected to the DMZ interface on the FOrtigate. Internal users are connected to the INSIDE interface.

the OUTSIDE interface connects to the edge router.

i have policies INSIDE -->DMZ allow all services, DMZ -->OUTSIDE allow all services on the fortigate.

I do not have any virtual IPs configured for the DMZ servers, since the edge router is the one performing the NAT function.

however, inside network cannot reach servers in the DMZ and DMZ servers cannot reach internet.

 

Any help on this please?

 

Thanks

Jaures.

 

    3 replies

    patrick_z
    patrick_z
    New Member
    February 26, 2015

    Hi,

    firewall in "NAT Mode" or "transparent"?

    You are routing IPs so DMZ and internal are different networks?

    The edge router knows about the IPs that are coming from Internal + DMZ?

     

    Cheers, patrick

    Jaures
    JauresAuthor
    New Member
    February 26, 2015

    Hello Patrick,

    Firewall is in NAT mode.

    Yes, DMZ and internal are on different networks.

    The edge router knows about internal and DMZ subnet IPs.

     

    patrick_z
    patrick_z
    New Member
    February 26, 2015

    Hi Jaures,

    and the firewall is default gateway for all the clients/servers behind the firewall?

    And static routing is set as well?

    Edge router needs a next hop routing for the DMZ and internal range with fortigate

    is next hop device. To say it in general: the edge router needs to know that the DMZ/internal

    network can be found behind the fortigate.

    No NAT is needed on the policies if IP routing only thing you want to have.

    So

    server --- DMZ --- fortigate --- outside ---Edgerouter

    client -- internal----/

     

    Check static routes

    Check policies - you will need internal -> DMZ

    internal -> outside

    DMZ -> outside

     

    If DMZ should be able to reach internal as well for some services you need a policy there as well.

    If this is not working then try to view traffic with diag sniffer packet <interface> 'none' 4

    there you should see incoming and outgoing interface etc. etc.

    google a little bit for more possibilities to use diag stuff

     

    Cheers, Patrick

    ashukla_FTNT
    Staff
    ashukla_FTNT
    Staff
    February 26, 2015

    Jaures wrote:

     

    however, inside network cannot reach servers in the DMZ and DMZ servers cannot reach internet.

     

    Based on the symptoms it seems the gateway on DMZ server is wrong.

    Terms & ConditionsAccessibility statement