Title: FortiWeb Lab Issue - HTTP Access to VIP Fails Despite Full Connectivity

Lab Setup:

Host Machine:

• Connected to internet.

• Default gateway: 192.168.1.1/24

• Running VMware Workstation

VM Configurations:

1. FortiWeb VM:

   • Port1 (LAN segment: WAN): 10.10.10.10/24

   • Port2 (LAN segment: Lan): 192.168.2.101/24

   • Port3 (Management - Bridged): 192.168.1.121/24

2. Windows Client VM:

   • LAN segment: WAN

   • IP: 10.10.10.2/24

   • Default gateway: 10.10.10.10

   • Firewall disabled

3. Windows Server_1 VM (IIS):

   • LAN segment: Lan

   • IP: 192.168.2.250/24

   • Default gateway: 192.168.2.101

4. Windows Server_2 VM (IIS):

   • LAN segment: Lan

   • IP: 192.168.2.240/24

   • Default gateway: 192.168.2.101

FortiWeb Configuration:

1. Created VIP: 10.10.10.50/24 on Port1

2. Created Virtual Server using this VIP

3. Created Server Pool:

   • Type: Reverse Proxy

   • Server Balance: enabled

   • Health Check: HTTP

   • Load Balancing: Round Robin

   • Added both servers (192.168.2.250 and 192.168.2.240)

   • Port: 80

   • Health check: Inherit

4. Created Policy:

   • Linked to Virtual Server

   • Linked to Server Pool

   • Protocol: HTTP

   • Log traffic: enabled
     

IIS Configuration:

• IIS installed on both Windows Servers

• Default website works when accessing localhost on servers

Current Situation:

What Works:

• Client can ping FortiWeb (10.10.10.10)

• Client can ping VIP (10.10.10.50)

• FortiWeb can ping client (10.10.10.2)

• FortiWeb can ping both servers (192.168.2.250 & 192.168.2.240)

• Both servers can ping FortiWeb (192.168.2.100)

What Doesn't Work:

• When client tries to access http://10.10.10.50 in browser → "Hmmm... can't reach this page"

• Also tried accessing FortiWeb interface IP (10.10.10.10) directly → same result

• No entries appear in Log Access > Traffic

• In FortiWeb Dashboard > FortiView Topology, servers show as "up" even when I shut them down (health check seems to be failing)

Troubleshooting already done:

• Confirmed all pings work between all devices

• Verified IIS is working locally on servers

• Disabled Windows firewalls on clients and servers

Question:
Why can't I access the website through the VIP despite full network connectivity? Why are the health checks failing (servers show up even when down) and no traffic appearing in logs?