Publishsing multiple Web sites using FortiGate and FortiWeb and only one public IP

Hello Salam,

To achieve this configuration on FortiGate, follow these steps using FortiGate's Virtual IPs (VIPs) and Firewall Policies:

1. Create VIPs: Each VIP entry maps the incoming requests on the specified external IP (your public IP) to the designated internal IP (192.168.1.50, 192.168.1.60, or 192.168.1.70). Make sure to enable port forwarding to map HTTPS (port 443) to the same port on the internal servers.

2. Set Up Firewall Policy: After creating the VIPs, set up corresponding firewall policies to allow HTTPS traffic from the external interface to each VIP.

Here’s the refined VIP Configuration:

config firewall vip
edit "aaa"
set extip x.x.x.x # Public IP on FortiGate
set mappedip "192.168.1.50" # Internal IP for aaa.test.com
set extintf "any"
set portforward enable
set extport 443
set mappedport 443
next
edit "bbb"
set extip  x.x.x.x # Public IP on FortiGate
set mappedip "192.168.1.60" # Internal IP for bbb.test.com
set extintf "any"
set portforward enable
set extport 443
set mappedport 443
next
edit "ccc"
set extip x.x.x.x # Public IP on FortiGate
set mappedip "192.168.1.70" # Internal IP for ccc.hello.com
set extintf "any"
set portforward enable
set extport 443
set mappedport 443
next
end

Firewall Policy Configuration

Once VIPs are configured, create firewall policies to allow traffic:

config firewall policy
edit 1
set srcintf "wan" # Adjust to match your external interface
set dstintf "lan" # Adjust to match your internal interface
set srcaddr "all"
set dstaddr "aaa" # Reference the VIP for aaa.test.com
set action accept
set schedule "always"
set service "HTTPS"
set logtraffic all
next
edit 2
set srcintf "wan"
set dstintf "lan"
set srcaddr "all"
set dstaddr "bbb" # Reference the VIP for bbb.test.com
set action accept
set schedule "always"
set service "HTTPS"
set logtraffic all
next
edit 3
set srcintf "wan"
set dstintf "lan"
set srcaddr "all"
set dstaddr "ccc" # Reference the VIP for ccc.hello.com
set action accept
set schedule "always"
set service "HTTPS"
set logtraffic all
next
end

This setup directs traffic based on the VIP configuration and ensures each request is routed correctly over HTTPS.