Request for Site Access via Specific Port

Forum|Forum|2 years ago
April 5, 2024
32 replies
7826 views

Hi,

Assistance with a network configuration. We have two internet modems in our current setup:

1. A fiber connection linked to the Forti WAN port.
2. A DIA with a static IP connected to Forti port number 4.

The internet is functioning correctly from the WAN port, now we need the user login to specified sites accessed exclusively through port number 4.

Modem: FortiWiFi 30E

Firmware: v6.2.15 build1378 (GA)

FortiGate

Best answer by Toshi_Esumi

So far looks fine. Can you ping "fast.com"? Since I can ping it from my 40F, you should be able to. If not, try traceroute.

fg40f-utm (root) # exe ping fast.com
PING fast.com (23.5.241.75): 56 data bytes
64 bytes from 23.5.241.75: icmp_seq=0 ttl=55 time=19.7 ms
64 bytes from 23.5.241.75: icmp_seq=1 ttl=55 time=19.6 ms
64 bytes from 23.5.241.75: icmp_seq=2 ttl=55 time=19.6 ms
64 bytes from 23.5.241.75: icmp_seq=3 ttl=55 time=19.6 ms
64 bytes from 23.5.241.75: icmp_seq=4 ttl=55 time=19.6 ms

--- fast.com ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 19.6/19.6/19.7 ms

fg40f-utm (root) # exe traceroute fast.com
traceroute to fast.com (23.5.241.75), 32 hops max, 3 probe packets per hop, 84 byte packets
1 63.231.10.70 <tukw-dsl-gw70.tukw.qwest.net> 1.366 ms 1.881 ms 1.909 ms
2 63.226.198.41 <63-226-198-41.tukw.qwest.net> 2.014 ms 1.898 ms 1.900 ms
3 * * *
4 4.69.219.65 <ae2.3605.edge9.sanjose1.level3.net> 18.981 ms * *
5 4.14.32.70 <citigroup-i.bar2.sanfrancisco1.level3.net> 200.976 ms 124.634 ms 203.926 ms
6 * * *
7 * * *
8 23.5.241.75 <fast.com> 19.540 ms 19.830 ms 19.459 ms

Toshi

dbu

Staff

Hi @ATOON ,

I believe you can achieve that by configuring static routes to those destinations and use the DIA connection (port4) as exit interface.

ATOONAuthor

New Member

Thanks for your reply, can explain the way

Toshi_Esumi

SuperUser

If the sites' IP won't change, the easiest way is to find out IP of the site by pinging Site1/2.com, and set two static route to those two /32 destinations toward port4. Then you need a general NAT policy toward port4 in addition to you already have twoard wan.

Since the default route is still pointing toward wan while only two /32 destinations are pointed toward port4, all other destinations should follow the existing policy toward wan.

Toshi

ATOONAuthor

New Member

Thanks for your message, IP of the sites is changed, need configure by FQDN

Toshi_Esumi

SuperUser

Ok, then try this:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-a-static-route-that-uses-a-FQDN-firewall/ta-p/197781

Toshi

AEK

SuperUser

Hello

If I understand well you need to:

Route access from internal user to siteA and siteB through port4
Route all other internet access through WAN port

Right?

Then you can for example integrate port4 and WAN interfaces in SD-WAN and configure all the above rules in a very simple way.

You can start here:

https://docs.fortinet.com/document/fortigate/6.4.15/administration-guide/889544/sd-wan-quick-start

AEK

ATOONAuthor

New Member

Hi bro,

I followed the method you're mentioned in the above link, but I did not find in the method mentioned the way to add the sites that I wanted to open on port no# 4.