New Member

Question

Issue with Virtual IPs

Forum|Forum|13 years ago
March 6, 2013
23 replies
11031 views

I have a complex setup (with multiple levels of NAT), but put simply, my problem is this: When I create a Virtual IP for a server on the LAN (to allow incoming connections from a trusted partner network), that same Virtual IP seems to be used for all outgoing traffic from that server to the internet. My provider' s firewall only allows outbound traffic from our firewall, and so connectivity is blocked. Is it normal behaviour for a Virtual IP to be applied to outgoing traffic as well as incoming, or is there a setting I' ve missed that prevents this?

ede_pfau

SuperUser

hi, and welcome to the forums! Yes, the default / intended behavior of VIP (destination NAT) is to conceal the private / mapped-to IP address completely. In previous versions of FortiOS only the reply traffic was NATed to the VIP. In 4.3 and higher, even originating traffic will use the VIP as source NAT. If that doesn' t work for you (where I wonder why...) you can specify a source NAT address if you check " dynamic NAT" in the outgoing policy - either the interface IP or a given IP pool with just one address. That should enable you to differentiate return traffic (natted to the VIP) from outgoing traffic (natted to the IP pool).

ICTServicesAuthor

New Member

Thanks very much! I' ve done a quick test and that looks like it will overcome our issues here. Much appreciated....

ede_pfau

SuperUser

That would be perfect! If it works for you, would you please post the How-To for others to follow?

ICTServicesAuthor

New Member

Yes - for future reference. Our ISP requires all outgoing traffic to come from our Firewall address. I' ve set up Virtual IPs for some servers (for incoming traffic) I then set a Dynamic IP Pool with the same IP address as the main Firewall outgoing IP address In the outgoing Firewall rules (Policy), under Enable NAT I selected ' Use Dynamic IP Pool' and selected the IP Pool set up above This then allows incoming traffic to come in to the servers via the Virtual IPs, but all outgoing traffic goes out on the one IP address. Thanks for pointing me in the right direction to solve this.

ede_pfau

SuperUser

You' re welcome. One simplification: if you just tick ' NAT' in the policy the IP address of the egress interface is used. This is just what you want so you can skip the IP pool here.

goftari

New Member

Hi! I have an issue which I may call it a Virtual IP issue: My Fortigate 311B has these ports: port1[Intranet],port2[DMZ], and port3[Internet] I have various types of traffic (Web, RDP, ...) coming in from the Intranet interface which is originated from clients with valid Internet addresses (routers in the intranet handle the routing); I have virtual IPs sending traffic coming from Intranet interface to servers in my DMZ (I have a policy in place to allow that), now after the traffic has come back from my DMZ, and source NAT has taken place for the reply traffic, I have packets with the source address of my Intranet interface and destination address of Internet. Here' s my problem: When I had a Mikrotik RB1000 in place of Fortigate it did handle this traffic, but now Fortigate does not force the traffic to go back through the Intranet interface. this issue can be resolved by having a static default route like this: 0.0.0.0 -> port1 [Intranet Gateway IP addr] But I don' t want to have a default route to my Intranet gateway, it does not seem logical to me! Please help ...!

ede_pfau

SuperUser

hi goftari, no need to hijack this thread - next time, open a new one please. Please check your policy ' intranet' ->' DMZ' and uncheck the ' NAT' checkbox. This will change the source address of reply traffic to the VIP used. edit: OK, OK, it' s not hijacking but cross-posting: http://support.fortinet.com/forum/tm.asp?m=94959 It' s best to choose the right forum (like this here, not the other) and post just once. Frequent fellow readers scan through ALL forums and will have a look at your issue anyway.

goftari

New Member

Sorry! I did open a new thread and nobody responded and as I really need this done and as I expected you replied faster (as I was looking in expert members score and as far as I mentioned you had the highest) May I continue on this thread to get my problem solved? or should I open a new thread? NAT is not enabled in my policy! By the way thanks for your prompt reply.

ede_pfau

SuperUser

Let' s continue here as this is the fitting forum for your question. As far as I can see the trouble is with source NAT. You can force a different source NAT in this way: - in Firewalls>IP pools, define a new IP pool with just one address: 172.18.0.100 - in the policy in which the VIP is used, - enable ' dynamic NAT' - select the IP pool you just created and test again. This will always change the source address of any egress traffic to the specified address.

goftari

New Member

OKay! I won' t cross-post again! I have dozens of Virtual IPs (Destination NATs) for dozens of my Intranet IP addresses and their ports mapped to dozens of my DMZ servers and their ports and I have just one single policy to just allow the traffic from all sources coming from my Intranet interface going through the DMZ interface and destination of all Virtual IPs defined. Source NATing for the reply traffic takes place correctly via the Virtual IPs defined for Destination NATing. the problem is that I cannot force the reply traffic through the Intranet interface as it has destination address of Internet, without having a default route to my Intranet gateway. (I' m not native English, excuse me for my grammar and choice of words)

ede_pfau

SuperUser

I can understand you loud and clearly. Could you please post the policy in question (from console, ' conf fire policy / edit <n>' ). How do you fit all VIPs into one policy - via VIP group?

goftari

New Member

No I didn' t use VIP Groups: config firewall policy edit 2 set srcintf " port4" -> Intranet Interface set dstintf " port2" -> DMZ Interface set srcaddr " all" set dstaddr " VIP#1" " VIP#2" " VIP#3" " VIP#4" " VIP#5" " VIP#6" set action accept set schedule " always" set service " ANY" next end

ede_pfau

SuperUser

I' ve looked it up in your other post which had all the details. The source of your trouble is the way how the web requests are routed to your intranet gateway. Solution: the gateway (10.10.10.150) should source NAT this traffic to it' s interface address (10.10.10.150) before routing it to your intranet interface.

goftari

New Member

I agree. But we don' t have access to the Intranet gateway 10.10.10.150. isn' t there any other way? I' m not familiar with Fortigate device but we had it working on our Mikrotik RB1000

ede_pfau

SuperUser

No, I don' t think there is a way to do it on the FGT alone. The routing just isn' t correct. The VIP (internal NAT table) will take care of the Intranet-to-DMZ traffic and route it back to the right interface, but not web requests... Could you set up a VIP only for the web traffic from Intranet? That is, on your intranet the default route would point to this VIP and not to 10.10.10.146. This way, the FGT could keep track of the ingress interface. But again, this is patch work. One other point is that the FGT will discard all traffic for which there is no route. For unknown addresses, it will use the default route. If such traffic enters on the intranet interface but the default route points to the WAN interface it will be discarded for security reasons.

goftari

New Member

On Mikrotik we could have static routes for specific packets having some routing mark which can be set using mangles. Then, I could create a mangle in prerouting chain to mark packets with source address of Intranet interface with a routing mark of to_Intranet, so I could have a default route to have all the traffic with to_Intranet routing mark through that. You mean I can' t achieve this on Fortigate in any way? P.S. I do really appreciate your time and consultancy up to this point; so please let me know if you' re done with this thread, if so I' ll take my chance by posting my last question as a new thread.

. Thanks Ede May I use DSCP to mark the incoming traffic from the Intranet interface to go back through it?

Show more replies

Sign up

Login with SSO

Login to the community

Login with SSO