Port Forwarding problem

Question

I am brand new to using the Fortigate and the methodology used is a bit confusing to me. The Fortigate is running v6.2.3 build1066 (GA) and I apparently can't update that since I don't have an active subscription?

The Fortigate is 192.168.1.1

I have set up a Virtual IP on interface (any) with external IP 10.10.10.10 and internal IP 192.168.1.2.

I created an Address of My Device, with IP 192.168.1.2 on interface (lan).

I created a Service of My Forwarding with Protocol type: TCP, address 192.168.1.2, Destination Port: TCP 12345.

I created a policy called My Device Policy.

Incoming Interface (wan)

Outgoing interface (lan)

Source (all)

Destination My Device

Service My Forwarding

Action Accept

Everything else in there is default.

When I attempt to use my connection program, the connection doesn't complete. I've searched online and I found an article that said to use the debug flow to verify that the Fortigate is handling the forwarding properly; however, when I use the steps given to turn on debug flow, I get no information back from the Fortigate when I am using my connection program.

So, is my setup for port forwarding correct? And what's the best way to troubleshoot this?

Toshi_Esumi · Answer

If the VIP's name is "MY Device", looks ok to me. I would either you create another VIP for "ALL_ICMP", then either swap it with the current one or put both in a VIP Group and use the group for the policy so that you can test it easily.

If ping works but TCP 12345 doesn't, likely the VIP itself is working but the device with 192.168.1.2 doesn't like what it's getting or having problem with replies. Then I would sniff at the device with like Wireshark to see what might be the problem. I would use "flow debug" after that point when I know the direct cause.

Depending on the model/size of FGT you have, the support isn't too expensive to be able to download a newer firmware like 6.2.10.

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO