Skip to main content
Jaures
Jaures
New Member
November 27, 2014
Question

Loopback interface used to NAT LAN users

  • November 27, 2014
  • 5 replies
  • 23427 views

Hello all,

I have a Fortigate configured as follow:

- WAN1 has a public IP (/30 facing the ISP device)

- i configured a loopback interface with a public IP (due to ISP settings, users have to be NATted to this loopback IP to be able to browse)

I have configured the corresponding Firewall policies, and LAN users can access the internet.

The issue i am facing is that the Fortigate itself cannot reach the internet.

Please any lead or advise on this?

Urgent!!!!!

Thanks,

Jaures.

    5 replies

    emnoc
    emnoc
    New Member
    November 30, 2014

    Why don't you just use a ip pool for the nat? On the fortigate not reaching the piblic internet; have you done a traceroute? do you have a route with the next-hop gateway that of the ISp ( /30 )

    Once you figure out the routing issues, set you policies for internal traffic src interface dst interface (WAN) with nat enable and the address listed in the ip pool.

    Jaures
    JauresAuthor
    New Member
    November 30, 2014

    Hello Emnoc, i am using ip pool for the nat (but i set the loopback IP as my pool) and my policy for internal traffic src interface (lan) dst interface (WAN) with nat enable is also using the address listed in the ip pool. My WAN interface is peering with the ISP with a /30 subnet. I have a route with the gateway being the IP address of the ISP device. When i traceroute internet from the fortigate, it goes through the ISP gateway. But as i have mentionned, LAN users are able to reach public internet.

    The fortigate cannot.

     

    Regards.

    Dave_Hall
    Dave_Hall
    New Member
    November 30, 2014

    Jaures wrote:

    But as i have mentionned, LAN users are able to reach public internet.

    The fortigate cannot.

    Hi Jaures. 

     

    What Emnoc is referring to, is similarly documented in KB#FD31034. 

     

    Can you clarify what you mean the Fortigate can not access the Internet?  If traceroute (to an outside IP address) works from the Fortigate CLI then it would seem the Fortigate just can not access the FortiGuard servers.  From the CLI can you ping a host by IP but not by FQDN?  If so then maybe you just need to set up a source-IP address under config system dns.

     

    Haven't thought this out, but instead of using an IP pool [strike]or loopback interface[/strike], what is stopping you from adding this IP address as a secondary IP address on your WAN1 interface?

     

    Edit: Thought a bit about it, I think you may still need to set up an IP pool.

    emnoc
    emnoc
    New Member
    November 30, 2014

    juares

     

    Try to set the  exec ping-options and source the loopback address as your source. Than do a ping to  8.8.8.8 from the loopback and the wan1 address and see if that fails or works. If it does, than you  know the  fortigate has access.

    emnoc
    emnoc
    New Member
    December 1, 2014

    OP 

     

    I'm on the road with ppor  internal but to answer part of problems, you need to find the  thread about sourcing  local interfaces for forticloud/fortiguard/dns. Do a search for the last 3 months and you will find how to make the  FGT works with "another" interface.

     

    If the isp  is not routing your  /30 than that would be the reasson for the loopback the reasons for your unable to ping the internet. If you should ever need to ping, use the exec ping-options and specifiy the interface that you want.

     

    Jaures
    JauresAuthor
    New Member
    December 5, 2014

    Hello Guys,

    Thank you for your replies.

    I finally asked the ISP to provide me with a /30 subnet routable through the internet, which they did.

    All is fine now. The Fortigate can reach internet through the WAN interface and can also reach Fortigard services.

     

    Thanks...

    Jaures.

    Terms & ConditionsAccessibility statement