Skip to main content
nintox
nintox
New Member
April 7, 2018
Question

Fortigate 200E - WAN2 - VIPs to servers in DMZ

  • April 7, 2018
  • 1 reply
  • 2449 views

Hello,

we a have a big struggle with our second WAN-Access on the fortigate 200E

I hope you can bring light into darkness.

The 2nd ISP provide us 4 WAN-IPs + the Gateway IP and because of the multible WAN-Adresses, we want to use it for our DMZ network, inside are our webservers which need some opened ports from the wan.

 

A little skizze for better understanding: 

 

                       |---------------VIP Forward---443--> Email-Server --- works well

ISP1  --->Expsed Network ---> WAN1 )-------> LAN 

 

                                                                       |  --> LAN to DMZ Policy --> all open

 

ISP2 ---> WAN2 (if: 192.168.0.254/24)) ---> DMZ (192.168.0.0/24)

                    |-------------VIP Forward-------------- Free WAN IP 1 ---> Internal Server

     WAN Gateway-Address (from the ISP)

                    |------------- VIP Forward -------------Free WAN IP 2 ----> Internal Server

                    |-------------VIP Forward-------------- Free WAN IP 3 -----> Internal Server

                    |.............VIP WAN IP 4

 

Problem is as follows: 

A created VIP over the ISP1 connection works pretty well. The definded internal server port is accessable from the wan.

But when we want to create a VIP with one of the free WAN IPs of our second ISP and forward ports the internal servers, the server is not accessable from the wan site. 

We can ping the gateway wan ip of the second ISP but not the other provided wan ips which wie define in vip-rules. 

Additionally we create two static routes one for the WAN1 and one for the wan 2. Also we create a policy route for DMZ to WAN-Connection. At this time the DMZ-Network got access to internet. But access fromt the internet to the DMZ still not working. 

I think we forgot something, but i don't know what?

    1 reply

    nintox
    nintoxAuthor
    New Member
    April 10, 2018

    I think, I solved the problem. 

     

    I forgot to edit the Weights of AD in the Static Routes. It needs to be in both routes the same weight.

    And I have to create a Policy Route which tells the FW, that incoming traffic for the DMZ should route over the second WAN-Access. 

     

    If this is the right solution, you can close the thread. Otherwise, tell me what's the better solution for this case. 

    Terms & ConditionsAccessibility statement