New Member

Question

FortiGate self originated traffics source IP changing

Forum|Forum|9 years ago
July 27, 2017
6 replies
16731 views

Hello All,

I have a fortigate 50E firewall.

The WAN interface IP is private IP 172.24.2.101/30 with gateway 172.24.2.102/30 and ISP have given a Pool of public IP as LAN.

I can set the public IP pool given by ISP as Virtual IP and use that in policy for internal users NAT to connect to internet and which works fine.

My issue is that the fortigate self originated traffic is still using WAN ip to connect to internet and it gets failed as it is a private IP.

Due to this device is unable to register, unable to activate webfilter and so on.

Is there any way to change the fortigate self originated traffic source IP when it used to communicate to internet?

Sunil_Panchal_NSE7

New Member

dear friend ,

i have the same issue . just recently we removed ISP cisco router due to fault in hardware of cisco router with fortigate 100e .

on wan side ISP gave us private ips and a pool of public ip. i am facing exactly same issue as you are facing .

please a quick response will be very helpfull

EMES

New Member

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-system-administration-54/Advanced/IP%20addresses%20for%20self-originated%20traffic.htm

You can set the source-ip to the inside interface which would fall under scrutiny of your IP Pool. the set source-ip must be an IP configured on the firewall.

config system fortiguard

set source-ip x.x.x.x

end

http://docs.fortinet.com/uploaded/files/2798/fortigate-cli-ref-54.pdf

If you look at the CLI reference and search for "set source-ip" you can find more options to set the source-ip.

Another option would be to create a Management VDOM, which means you would logically split the firewall in two thus allowing you have a true Out of Band Management Interface.

Hope that helps

pushpendra11

New Member

Hi Lubonline,

Please check the output of "get system source-ip status" with the help of this you can verify the actual ip that it is using to reach the fortiguard.

You can change the source-ip to the desired one if it is not appropriate in the output.

Regards,

Pushpendra11

lubionlineAuthor

New Member

Hello,

Thanks for the inputs.

I have already tried to set the source ip but it is the same.

Logged a case with Fortigate support and they took remote session for two times for around 2hours each and still unable to fix it.

I will let everyone know if any positive progress.

Lijo_Joseph

New Member

Hi, I am facing the same issue with one of our FGT 101E device and I want to source traffic from a loopback . Even the traffic is not sourced from a mgmt interface as I have dedicated HA mgmt interface enabled. Wondering if anyone has found a solution already to this

Sign up

Login with SSO

Login to the community

Login with SSO