Fortiweb not forwarding to single back end server.

Forum|Forum|2 years ago
February 11, 2024
12 replies
4874 views

Really simple set up. I have a VIP which is just the interface (PORT 3) and I have a policy, that uses the VIP and a server pool of 1 backend web server, which is on the same VLAN, (one arm deployment I believe its called) this server is up and listening on port 80, the FWEB does nothing with it, so I must of missed something simple?

I do a capture, and can see the client come in, targeting port 8080. I see the 3-way handshake, but nothing get sent to the backend webserver?

I can ping the web server and do a telnettest on port 80 and it comes back "connected" really struggling to see whats wrong, back end server pool is all correct and listening on port 80

any silly mistakes I may have made?

FortiWEB

Best answer by The_Nude_Deer

Issue us resolved, thanks for your time, default Mgmt port is 8080, the same port used for Proxy listening! i changed this in settings to 8081 to free up 8080 to be used as the HTTP listener, the back end wasnt recieving traffic, as it was MGMT traffic! bit daft why it would use 8080 as the default HTTP for manangement!

AEK

SuperUser

Enable traffic logs on the policy and redo the test. Then share what you see on both traffic log and attack log.

AEK

The_Nude_DeerAuthor

Explorer II

Fairly new to these. where is the logging for the policy? If I goto Policy > Server Policy and edit my policy, there is no option to enable traffic logs? EDIT : FOUND THE SETTING, looking at X-FORWARDED FOR setting too, these seem important?

AEK

SuperUser

Here it is:

https://community.fortinet.com/t5/FortiWeb/Technical-Tip-How-to-enable-traffic-logs-for-version-7-0-and/ta-p/214259

AEK

brukeo6

New Member

Maybe I'm not so smart but you can't send and receive traffic on the same interface and VLAN. Surely your broadcast domain either forwards on layer 2 or routes it to a different IP out a different interface/VLAN?

The_Nude_DeerAuthor

Explorer II

Yes you can, its called one arm proxy, the web server and VIP can be in the same VLAN / IP Range.

The_Nude_DeerAuthorAnswer

Explorer II

Issue us resolved, thanks for your time, default Mgmt port is 8080, the same port used for Proxy listening! i changed this in settings to 8081 to free up 8080 to be used as the HTTP listener, the back end wasnt recieving traffic, as it was MGMT traffic! bit daft why it would use 8080 as the default HTTP for manangement!

Sign up

Login with SSO

Login to the community

Login with SSO