Port Forward or Service required for multiple ports to a single IP.

Forum|Forum|9 years ago
February 17, 2017
4 replies
23365 views

Using this as a guide: http://docs.fortinet.com/uploaded/files/1652/using-port-forwarding-on-a-FortiGate-unit.pdf

It recommends creating a VIP with port forwarding enabled for each port I want to forward. This seems like a ton of work considering we can add services with ports defined to the policy that is required. I have tested on my 50E using 5.4.3 that creating a single VIP with a policy and multiple services is working, but is there something I am overlooking by NOT having port forwarding enabled on the VIP?

Thanks.

Policy

brycemd

New Member

Not specifying the ports would be the beginnings of a one to one NAT. This means you can only port forward that external IP to a single internal IP. If you specify ports you can use the external IP for multiple internal IPs(as long as the ports don't overlap).

For example, if you have multiple external IPs to use, you can do a VIP without specifying ports to an internal IP, then you could use the IP pool in the policy to have outgoing traffic use that IP as well.

But, I guess to answer your question, there is nothing wrong without specifying the ports in the VIP... until you need to port forward to more internal IPs. Then you'll need to redo it.

rwpatterson

New Member

The key here is: How many external IP addresses do you have or wish to use? If you only have one, port forward is your only option if you wish to publish multiple internal hosts. Also with the one to one, there is no longer the option to access the Fortigate as all ports are now sent to the inside host.

mlarcherAuthor

New Member

So the ports are not restricted to only the ones in the attached service? I am not adding "all" to the policy.

VIP = external ip (only one) > internal IP no port forward configured.

Policy = In: Wan1 Out: Lan (hw switch)

Source: all Dest: VIP object

sched: always Service: RDP

Nat: no

This configuration is working, I can still access the forgtigate, and access the server from the outside. I have another policy fwding another port to another internal server which is working, at the moment I have no need to have the same port go to different internal IPs.

Thanks for helping me understand this.

Sign up

Login with SSO

Login to the community

Login with SSO