Hi, How to SSH to cisco switches inside network of Fortigate through the internet?

Hi @clintz ,

Below is the simplest layout—each internal switch gets its own TCP port on the FortiGate’s public IP. You restrict the source to 2.2.2.2 /32 so no one else on the Internet can try.

Step-by-step on the FortiGate

1- Define the source address (your home IP)

(GUI: Policy & Objects ▶ Addresses ▶ New)

https://docs.fortinet.com/document/fortigate/7.0.0/ngfw-deployment/680739/creating-address-objects

config firewall address
edit Home-IP
set subnet 2.2.2.2 255.255.255.255
next
end

2- Create one Virtual IP (VIP) per switch

(GUI: Policy & Objects ▶ Virtual IPs ▶ New)

https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/446182/virtual-ip-with-services

config firewall vip
edit Sw1-SSH
set extip 1.1.1.1 # or “interface” if your WAN is PPPoE
set extintf "wan1"
set extport 2221
set mappedip 10.0.1.1
set mappedport 22
set protocol tcp
next
edit Sw2-SSH
set extip 1.1.1.1
set extintf "wan1"
set extport 2222
set mappedip 10.0.2.1
set mappedport 22
set protocol tcp
next
edit Sw3-SSH
set extip 1.1.1.1
set extintf "wan1"
set extport 2223
set mappedip 10.0.3.1
set mappedport 22
set protocol tcp
next
end

3- Add one WAN→LAN policy that covers all three VIPs

(GUI: Policy & Objects ▶ Firewall Policy ▶ New)

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Create-a-firewall-policy-using-a-Virtual-IP-VIP/ta-p/332394

config firewall policy
edit 0
set name "SSH-to-Switches"
set srcintf "wan1"
set dstintf "lan"
set srcaddr "Home-IP"
set dstaddr "Sw1-SSH" "Sw2-SSH" "Sw3-SSH"
set schedule "always"
set service "SSH"
next
end

These configuration helps through the exact VIP and policy configuration used to expose your internal Cisco switches over SSH while limiting access to your own public IP.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

Hi,

There are 2 options.

1. Take SSH of fortigate firewall and from there SSH to cisco switches with command "execute ssh admin@10.0.1.1". 

2. Create a VIP and use IP and port forwarding option for all 3 switches. Please note use different ports other than usable ports. External IP should be FW WAN IP, map it to cisco switch with port forwarding.