Skip to main content
erotavlas
New Member
June 20, 2019
Question

Fortigate 100D: configuring DMZ

  • June 20, 2019
  • 1 reply
  • 13161 views

Hi, I'm new of this forum and of fortinet device. I have to install a Web server on GNU/linux zentyal 6 in a network managed by a fortinet fortigate 100D v6.0.5 build0268 firewall with DNS and active directory provided by Windows server 2016 machines. I followed this guide https://cookbook.fortinet...eb-server-with-dmz-54/ about how to setup a DMZ for the Web server. The only thing that is different in my configuration compared to the guide is that I'm using a DMZ port on the firewall instead of port3 as interface. So I have LAN on 10.0.0.0/16 network, DMZ on 10.10.10.0/24 networks (Web server with fixed internal IP 10.10.10.2/24, gateway 10.10.10.1 and DMZ with fixed external IP) and fortinet on 10.10.10.1 (DNS and active directory on LAN). At the moment, I can execute ping from firewall toward Web server and the opposite. While I'm not able to reach the Web server both from internal LAN and external network. Moreover, I cannot reach Internet from my Web server (I have to investigate if it could be a DNS problem). What am I missing? Thank you

1 reply

hubertzw
New Member
June 20, 2019

Do you have firewall policies for LAN-DMZ? You need this for DNS for example. Do you have ICMP in the policy INTERNET-DMZ or only HTTP, HTTPS? Don't leave ICMP in the production. Limit the number of protocols to minimum.

julienlux
New Member
June 20, 2019

On your post you mentionned that Webserver ip is 10.10.10.2 and Gateway 10.10.10.2. Do I understand correctly?

 

What is the IP of DMZ port of your Fortigate? This ip should be the default gateway of your server.

erotavlas
erotavlasAuthor
New Member
June 21, 2019

julien.lacava wrote:

On your post you mentionned that Webserver ip is 10.10.10.2 and Gateway 10.10.10.2. Do I understand correctly?

 

Thank you, I corrected my post. The gateway of the Web server is 10.10.10.1.

julien.lacava wrote:

What is the IP of DMZ port of your Fortigate? This ip should be the default gateway of your server.

How can I check it? I assigned a subnet 10.10.10.0/24 to the DMZ interface and so I think it should be 10.10.10.1.