NAT rule issue with my Fortinet 60C

hi, and welcome to the forums. If your VIP is port forwarding you will not be able to ping the internal server. Ping is an application of the ICMP protocol which doesn' t use ports. You will probably be forwarding TCP on port 80 or 443 which doesn' t cover ping. The only way to have ping go through a VIP is to make the VIP non-portforwarding. This will consume the public address completely, though. With a decent tool you could " tcp ping" your server - there are tools around which try to establish a TCP connection and report the response. BTW, best practise would put the ' exposed' server on a Fortigate port of it' s own, and not have external traffic traverse the whole LAN via the LAN switch. The 60C should have some spare ports for this... In your setup the default route on the FGT should point to the modem (.11.1). The WAN port of the FGT will not have a public IP which will make receiving the FortiGuard updates a bit more difficult. If possible, put the modem into ' bridge mode' and put all credentials onto the FGT. For instance, I do this for PPPoE ADSL modems. In this case, the FGT will be truly the gateway and have a public WAN IP. Anyway, does your setup work except for the ping? If you still have questions, please state the FortiOS version you are using.

Hi Ede_pfau, Thanks for welcoming me and your reply. - My FGT 60C using firmware v5.0 built 0147 (GA patch 1). - Yes, in diagram, default route exactly pointed to 11.1, it worked well without any problems even fetching Guard updates...Your idea to change ADSL to bridge mode is what I thought also..but would be better to remain the things for some reasons (on-line configure/not enough man-power there...). - Using " exposed" port as your mentioned that' s meaning we will hook the server into DMZ port ? I think the one will be the last consider with the reason as above listed. - in VIP I had allowed ALL, I though with using that option, ICMP protocol to allow ping command. Yes, ICMP does not using port, thank you. >> Do you have any experiences on how to allow user from Internet can go thru the Server inside LAN without changing ADSL/default gateway/DMZ port? looks like 02 times of NAT - 1 from Internet to WAN segment and 1 from WAN to LAN segment. Have tried many times with VIP/Policy/NAT but still not able to get traffic as wanted. Regards.

I don' t see any reason why double NAT would prevent traffic if the correct routes are set. The modem in bridge mode was just a suggestion NOT related to your problem. I do it for a simple reason: no config on the modem itself. If it burns from line voltage spikes I can just send a replacement to the remote site and have it connected. Might be because I' ve had a long day (with family :) but I lost the idea what your problem really is: the FGT can connect to the FortiGuard servers (which I didn' t expect), and outbound traffic seems not to be the problem. Inbound traffic is using a VIP - be sure not to check ' port forwarding' which is different from specifying all ports. Whether you use the internal port for your server or another dedicated port of the FGT is a question of security, not of technical importance. I tell my customers to see the DMZ server as being hacked - how much more damage can an attacker inflict on the LAN then? With just one server in the DMZ, and NO policies from DMZ to internal LAN, not much...having the server in the middle of the internal LAN though makes a big difference. For further help, we need - the VIP definition - the policy it is used in (WAN -> internal) - the routing table (from Routing Monitor) if possible as text snippets from the command line/console.

Hi Ede, Here are some info config firewall vip edit " ServerNAT" set extintf " wan1" set portfoward enable set mappedip 192.168.10.50 set extport 80 set mappedport 80 next end edit 7 set srcintf " wan1" set dstintf " internal" set srcaddr " all" set dstaddr " all" set action accept set status disable set schedule " always" set service " ALL" next config router static edit 3 set device " wan1" set gateway 192.168.11.1 next At ADSL router, I had assigned the rule: Source ANY port 8080 transfer to port 80 interface WAN1. " ...but I lost the idea what your problem really is: the FGT can connect to the FortiGuard servers (which I didn' t expect), and outbound traffic seems not to be the problem" >>> Actually, if leave it as normal, Guard will not connect to servers...had just opened 2 ports in ADSL using connect to Guard services then it is ok. " Inbound traffic is using a VIP - be sure not to check ' port forwarding' which is different from specifying all ports" >>> I' m sorry that I can' t understand...can you please explain for me more? Any info that your need to investigation, please let me know. Thanks much.

OK, that information was badly needed! 1. disable port forwarding in the VIP config 2. policy 7 is NOT active - ' set status disable' 3. create a new policy, with - source interface: wan1 - source addr: all - dest interface: internal - dest addr: your_VIP <==== this is important!! - no NAT 4. the static route is OK Now you can ping the server from the WAN port. To test, disconnect the modem, connect with a notebook with IP address .11.1 and ping the server. Try HTTP on port 80 also. And I see that your server will only be accessible via port 8080 from outside.

I will test that and keep you update, Ede...thanks a lot for your support.

Thanks for your confidence. Please check and change these points: 1.

 config system interface      edit " wan1"           set mode static          set ip 192.168.111.2 255.255.255.0  

shouldn' t that be in the 192.168.11.x range? 2.

 config firewall vip      edit " ServerNAT"           set type static-nat          set extip 0.0.0.0          set extintf " wan1"           set portforward disable          set mappedip 192.168.10.50      next  end

change to

        set extip 192.168.11.x  

where 192.168.11.x is the external IP address used for the internal server 3. policies - delete, delete, delete policy ID 8 - policy 4 covers policy 5, I' d delete policy 5 - policy 7 (the NAT policy) looks OK

Dear Ede, Please see my in-line discussion as below: #1: This is my fault...I reverted back to the right IP address for WAN1 (11.2) #2 : Already changed as your guide. #3: Sorted out meaningless policy 8, policy 5 actually has a little bit different with 4 so I will keep that. But...:-( still can' t. What am I missing? Thanks.

Just wanna confirm that I have solved that issue by open another DMZ connection as suggested. Sorry for the late reply and thank you.