Skip to main content
TimeCop79
TimeCop79
Explorer II
March 15, 2024
Question

Port forwarding issue with two different ports

  • March 15, 2024
  • 3 replies
  • 4483 views

Hi

I have configured port forwarding on my FGT 60D to allow RDP access to 2 computers with the IP addresses 192.168.1.10 and .20, and the source ports 3389 and 3390. I created the virtual IPs for each and the policy. For the address 192.168.1.10/3389, RDP works perfectly, but for 192.168.1.20/3390, it doesn't work. The computers are connected through a router with a private address of 10.0.16.62. I even tried modifying the VIP of the address 192.168.1.10 with port 3390, but it still doesn't work. Thank you for helping me.

3 replies

ozkanaltas
ozkanaltas
Valued Contributor III
March 16, 2024

Hello @TimeCop79 ,

 

Could you share vip configuration with us? 

    TimeCop79
    TimeCop79Author
    Explorer II
    March 16, 2024

    IMG_20240316_122245.jpg

    this the first VIP that works fine, the second VIP is same but with 192.168.1.20 as mapped ip and 3390 as external service port

    ozkanaltas
    ozkanaltas
    Valued Contributor III
    March 16, 2024

    Hello @TimeCop79 ,

     

    I see that, you use private ip as a external ip. Did you do nat configuration on isp router for 3390. In this scenerio need to this. Also you can sniff the traffic for 3390. If you cant see any traffic. You need to look your isp router.

     

    diagnose sniff packet any "port 3390" 4 0

     

      ssteo
      Staff
      ssteo
      Staff
      March 16, 2024

      Hello,

       

      You can run packet sniffer on Fortigate and verify whether got incoming traffics or not.

      Below is the command:

      diagnose sniff packet any "port 3390" 4 0

      If you did not see any output, it might block by upstream device.

        TimeCop79
        TimeCop79Author
        Explorer II
        March 18, 2024

        thanks for reply, i do the test but no packet recieved for 3390 while for 3389 it works

        ozkanaltas
        ozkanaltas
        Valued Contributor III
        March 18, 2024

        Hello @TimeCop79 ,

         

        In my opinion, you need to check your router configuration. I think your router does not allow 3390 traffic.

          mpeddalla
          Staff
          mpeddalla
          Staff
          March 16, 2024

          Hello  @TimeCop79 ,

           

          Thank you for contacting the Fortinet Forum portal.

           

          I understand you are having issues with VIP. Here are some ideas you could try.

          First of all, I would recommend running the sniffer on all hops to verify where the traffic is stuck. Start running on FortiGate then the private router and on the end device so that we can trace each packet to see where we are losing packets 

          refer below article to run the sniffer :

          https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Packet-Capture-on-FortiOS-GUI/ta-p/194444

           

          Second, verify the firmware version of Fortigate as there are some behavior changes in VIP and IPpool after 7.2.5.

          https://community.fortinet.com/t5/FortiGate/Technical-Tip-IP-pool-and-virtual-IP-behavior-changes-in-FortiOS/ta-p/277823

           

          Finally, check the below which helps to validate additional logs for VIP issues :

          https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Troubleshooting-VIP-issues/ta-p/227616

           

          I hope this helps to verify behavior. Let me know further updates.

           

          Best regards,

          Manasa.

           

          If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.

            Terms & ConditionsAccessibility statement