How to View the Real Source IP?

Forum|Forum|13 years ago
March 11, 2013
11 replies
11563 views

I am using a VIP for an internal web server, the problem that that the web logs shows the Source IP of the users accessing the web as the FG' s internal interface IP is there a way to configure the FG to pass the real source IP Address?

romanr

New Member

Your " wan -> internal" policy seems to have NAT enabled, which is not needed there. So you nat the external clients behind your internal firewall IP... The VIP configuration handles the destination NAT itself. br, Roman

FG-PioneerClientAuthor

New Member

Roman, I don' t NAT enabled on the Policy, because the NAT is already done by the VIP.. Thanks, Shamsan

rwpatterson

New Member

What IP address is your server seeing? If it' s the inside address of the Fortigate unit, then NAT is enabled. If it' s something else, look to that device for NAT enabled.

FG-PioneerClientAuthor

New Member

If you meant the Operation Mode yes it is NAT I am trying to configure the FG to pass the real source IP it receives, that I am seeing in Traffic Log ..

ede_pfau

SuperUser

We could help you more if you gave more information. Please post the VIP definition and the policy it is used in. Copy&paste from the console window:

 config firewall vip     show    config firewall policy     edit <n>        show

FG-PioneerClientAuthor

New Member

Sure, here you go config firewall vip show edit " HTTP" set extip 10.10.10.10 set extintf " port26" set portforward enable set mappedip 1.1.1.1 set extport 80 set mappedport 80 next config firewall policy edit <n> show config firewall policy edit 1000 set srcintf " port26" set dstintf " port25" set srcaddr " all" set dstaddr " HTTP" set action accept set schedule " always" set service " HTTP" set logtraffic enable set logtraffic-app disable next end

emnoc

New Member

What might also be beneficial is a snippet of your weblogs, and example or clue as to what src-address is being logged in you weblog using the configuration your providing. In the VIP your showing, I typically don' t use port-forwarding but map the vip in fashion like the following when dealing with web services; edit " VIP_38_xx7_8x_35-web02" set extip 38.xx7.8x.35 set extintf " EXT_NET01" set mappedip 10.10.100.31 next maybe the behavior of a mapped ipaddress that' s portforward vrs non-portforward is different.

FG-PioneerClientAuthor

New Member

Actually the weblog is just showing the internal interface of the FG, which is the gateway of the web server.. I have tried removing Port Forwarding but still the same ..