Problem with VIP evaluation

Forum|Forum|6 years ago
April 17, 2020
6 replies
8595 views

I found a problem with VIP with port forwarding when several VIP are mixed binded to different interface. I discover this problem using hairpin policy to reach service from internal machine with public ip address of the service. If the vip I want access are after another vip with bind to different interface, the next vip are not evaluated. Example. VIP1 x.y.z.w:80 -> a.b.c.d:80 ANY VIP2 x.y.z.w:81 -> a.b.c.d:81 ANY VIP3 x.y.z.w:82 -> a.b.c.d:82 ANY VIP4 x.y.z.w:83 -> a.b.c.d:83 ANY VIP5 x.y.z.w:84 -> a.b.c.d:84 WAN VIP6 x.y.z.w:85 -> a.b.c.d:85 ANY connection to x.y.z.w:83 work well since all vip before are binded to any interface but if i try the same with x.y.z.w:85 it doesn't work. Debugging flow I see that VIP4 are matched, instead VIP6 are never matched.

I have checked on fortios 5.6, 6.0 and 6.2 and all have the same issue

6.0

Best answer by emnoc

Do you have " set match-vip enable" on the policy ? If you feel a problem exists open a support , complaining here is not going to get you a fix. Make support aware that you think its' any issue(s) & that they need to address.

Ken Felix

emnoc

New Member

You fix as you know is to change "wan" to any and then it would work. This is a known issue with vips and mix of ANY and interface which could cause issues just like yours

BTW, I ran into that same issue many years ago when looking at a existing fortigate and it took me a while to figure it out.

Ken Felix