Skip to main content
lvfranz
New Member
Apr 17, 2020 3:05 PM UTC
Solved

Problem with VIP evaluation

I found a problem with VIP with port forwarding when several VIP  are mixed binded to different interface. I discover this problem using hairpin policy to reach service from internal machine with public ip address of the service. If the vip I want access are after another vip with bind to different interface, the next vip are not evaluated. Example. VIP1      x.y.z.w:80 -> a.b.c.d:80        ANY VIP2      x.y.z.w:81 -> a.b.c.d:81        ANY VIP3      x.y.z.w:82 -> a.b.c.d:82        ANY VIP4      x.y.z.w:83 -> a.b.c.d:83        ANY VIP5      x.y.z.w:84 -> a.b.c.d:84        WAN VIP6      x.y.z.w:85 -> a.b.c.d:85        ANY connection to x.y.z.w:83 work well since all vip before are binded to any interface but if i try the same with x.y.z.w:85 it doesn't work. Debugging flow I see that VIP4 are matched, instead VIP6 are never matched.

 

I have checked on fortios 5.6, 6.0 and 6.2 and all have the same issue

emnoc
emnocAnswer
New Member
Apr 21, 2020 5:21 PM UTC

Do you have " set match-vip enable" on the policy ? If you feel a problem exists open a support , complaining here is not going to get you a fix. Make support aware that you think its' any issue(s) & that they need to address.

 

Ken Felix

6 replies

emnoc
New Member
Apr 17, 2020 4:35 PM UTC

You fix as you know is to change "wan" to any and then it would work. This is a known issue with vips and mix of ANY and interface which could cause issues just like yours

 

BTW, I ran into that same issue many years ago when looking at a existing fortigate and it took me a while to figure it out.

 

Ken Felix

lvfranz
lvfranzAuthor
New Member
Apr 21, 2020 10:15 AM UTC

i don't understand why fortinet doesn't fix this issue.

change bind of vip are a bit complicated, I must remove the vip from all policy and then readd to all disrupting all traffic

emnoc
New Member
Apr 21, 2020 2:30 PM UTC

I don't think it's a "issue" but just how it works. You have to know the pitfalls of mix and when any is appropiate or not.

 

Ken Felix

 

sonychemp
New Member
Nov 18, 2021 9:52 PM UTC

We had similar issue on 900D & 600D running code 6.4.5.

Issue.

All VIP was using interface as "any" .

We changed to "WAN" and it worked.

We then reverted to "Any" and it started to work.

we have the following.

Public IP to Server IP/Port

Private IP to Server ip/port.

When we deleted on of the VIP, this issue triggered.

 

They said its internal BUG and they will work with Developers.

First we hit on 600D and after 2 months we had similar issue on 900D.

 

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT