New Member

Solved

[SOLVED] Fortigate Port Forwarding to several internal hosts

Forum|Forum|7 years ago
April 20, 2019
8 replies
24791 views

Good day!

Does anybody use port forwarding from 1 external ip to several internal hosts?

For example, I have IP 1.1.1.1 on wan1 and want to translate port 21 to 192.168.1.2:21, port 25 to 192.168.1.3:25port 80 to 192.168.1.4:80.

First virtual IP was created without any problem. But when I try to add second VIP with my 1.1.1.1 external IP, I catch this error: "Conflicts with the External IP of another VIP". I've created only 2 VIPs on wan1 at all - first 1.1.1.1:21 -> 192.168.1.2:21 and second 0.0.0.0:25 -> 192.168.1.2:25. Third VIP I cannot create.

Another vendors, such as Cisco or Zyxel, can translate too much external ports to different local hosts and ports.

I'm guess, that Fortigate can do the same. But I haven't find any manual for this.

Only 1 external IP to 1 internal IP.

Thanks in advance for your help.

6.2

Best answer by Toshi_Esumi

How about his cookbook?

https://cookbook.fortinet.com/using-virtual-ips-configure-port-forwarding-54/

Toshi_EsumiAnswer

SuperUser

How about his cookbook?

https://cookbook.fortinet.com/using-virtual-ips-configure-port-forwarding-54/

tsypyshev_piAuthor

New Member

Hi Toshi! Thanks for your answer. I've read this article before. But every time I've stopped when I saw red highlighted text "Conflicts with the External IP of another VIP". Only today I've tried setup all external and internal IPs and when I've defined external port then this error message was disappeared. It's really discourage message. Thank you very much for help!

Thompsons

New Member

I've been running into this issue too.

How did you get around it? It seems like a firmware update issue because if I edit some of the existing VIPs I receive this error but if I cancel out, they work fine.

Did you find a way to get around this issue?

korwinau

New Member

I've been trying to perform port forwarding myself for the past day or two however i'm working with a Dynamic IP on the WAN interface (everything I've read suggests leaving the extIp as 0.0.0.0). I ran into this exact same problem however mine came from specifying mutliple VIPs in which a port is used for both TCP and UDP. I found that the "duplicate" could be added when using the CLI which would suggest a GUI bug.

Try using the bellow (obviously name it whatever you need to and set the extintf to the correct name for your setup).

config firewall vip edit "Second 1.1.1.1 VIP" set extip 1.1.1.1 set extintf "wan interface" set portforward enable set mappedip 192.168.1.2 set extport 21 set mappedport 21 next end

ede_pfau

SuperUser

That's correct, you actually need to use '0.0.0.0' if the WAN IP is dynamic. Slipped on that one.

So, in the end, a GUI check routine prevents a totally valid config. This isn't the first time such a thing happens.

orani

New Member

I think you can't configure the port forward for port 80 because your fgt listens to port 80 for its web gui. If you change that port you will be able to do what you want

Sign up

Login with SSO

Login to the community

Login with SSO