help - fortigate - failed redirecting address from 1 port to another port

Question

hello there,need help please. we use Fortigate FG-30E. we have 2 subnet in different port.subnet 192.168.0.0 /24 in port 1subnet 192.168.100.0/24 in port 2there is 1 host in port 2 with IP 192.168.100.1 as web server.We want for all user in port 1 , enter web address 192.168.100.1, it will redirect to host 192.168.100.1 in port 2. we have configured:1. add IP Policy from port 1 to port 2:- SOURCE: SUBNET 192.168.0.0/24- DESTINATION:SUBNET 192.168.100.0/24- NAT ON- SERVICE ALL, time always.- accept 2. add IP Policy from port 2 to port 1:- SOURCE: SUBNET 192.168.0.0/24- DESTINATION:SUBNET 192.168.100.0/24- NAT ON- SERVICE ALL, time always.- accept 3. set Policy route - incoming : port 1- destination: subnet 192.168.100.0/24 , address: 192.168.100.1- action: forward traffic- outgoing interface: port 2 ; gateway: 192.168.100.1 result failed.please advice. what we've missed here. thanks in advance

akileshc · Answer

Hello,

The configuration part looks fine, It's better to understand the traffic flow on Fortigate before considering any changes.

But, the gateway IP address configured in policy route "192.168.100.1" is a server itself hosted behind Port2 or an IP address configured on the Interface Port2? (I believe the Policy route isn't required in this case)

Run the below-mentioned commands on Fortigate simultaneously on two different SSH sessions and then initiate the traffic.

SSH1:

get sys status

di ip address list

get router info routing-table all

diagnose debug reset

diagnose debug disable

diagnose debug console timestamp enable

diagnose debug flow show fun en

diagnose debug flow filter clear

diagnose debug flow filter addr 192.168.100.1

diagnose debug flow trace start 1000

diagnose debug enable

After connection failed, disable the logs by executing

diagnose debug disable

SSH2:

# diagnose sniffer packet any "host 192.168.100.1" 4 0 a

Sign up

Login with SSO

Login to the community

Login with SSO