Routing Problem - Any Suggestions

Hello RolandBaumgaertner72,

As far as i understand you have topology like this one bellow :

Azure_HQ <-IPsec-> Fortigate_Main_location <--MPLS--128.x.0.0/16--> <ABC_location_128.x.20.0/24> <--local_LAN--> 192.168.30.0/24.

The goal is to establish session (TCP or UDP) from Azure_HQ to ABC_location for destination 192.168.30.x ?
You can try to do a DNAT/VIP on ABC_Location and map 128.x.20.x/24 to 192.168.30.0/24. Let's say the WAN of ABC_location is 128.x.20.1 and you can MAP it to 192.168.30.30.
From Azure_HQ you have a route for 128.x.20.1 via the IPsec tunnel, then that traffic will be forwared throught MPLS to ABC_location, after that VIP/DNAT will do the translation from 128.x.20.1 to 192.168.30.30.

Best regards,

Fortinet

Hi,

this is what I tried. I configured a VIP on the MPLS interfae with NAT for 128.X.20.7 and mapped it to the internal printer 192.168.30.30 with port forwarding 9100. Now I can telnet 128.X.20.7 to the printer and connect via 9100.

BUT it is not printing. On the web on the printer in the LAN I get completed but it is not printing. I think the VIP and the communication is OK now but still no idea why the printer is not printing. Testing it on the LAN it works fine.

Thanks!

Hello,

You can try to do a sniffer and debug flow for the source IP address of the PC behind the Azure:

SSH No1:

diagnose debug reset

diagnose debug disable

diagnose debug flow trace stop

diagnose debug flow filter clear

diagnose debug flow show iprope enable

diagnose  debug  flow show function-name enable

diagnose debug flow filter saddr x.x.x.x <--- where x.x.x.x is the IP address of the source PC

diagnose  debug  console timestamp enable

diagnose debug flow trace start 10000

diagnose debug enable

SSH No2 :

diagnose sniffer packet any "host x.x.x.x " 4 0 l <-- where x.x.x.x is the IP address of the source PC

So you can see if the printer requires more ports to be opened .

Best regards,

Fortinet