Trying to setup inbound rules via CLI, also need help setting up ssl vpn

Forum|Forum|8 years ago
January 11, 2018
2 replies
2714 views

Thanks. Trying to help a friend setup a fortigate 60E. Totally different when compared to a cisco asa, pix or a checkpoint FW. I need to figure out how to setup a rule that will allow a inbound connection from client A at ip xxx.xxx.xx.xxx on ports 2001, and 2011 to a internal host at 192.168.1.238. I also would like to setup a vpn connection my home network, to allow me to login to the fortigate and use the web interface. any resources or a starting point would be helpful. thanks again

emnoc

New Member

I need to figure out how to setup a rule that will allow a inbound connection from client A at ip xxx.xxx.xx.xxx on ports 2001, and 2011 to a internal host at 192.168.1.238.

It's actually simple but here what I would do config firewall service custom edit port2001 set tcp-range 2001 next edit port2011 set tcp-range 2011 end config firewall address edit myinsidehost set subnet 192.168.1.238/32 next edit theremotehost set subnet xx.xx.xx.xx/32 end config firewall policy edit 0 set srcintf WAN1 set dstint LAN set srcaddr theremotehost set dstadr myinsidehost set service port2001 port2011 set action accept set schedule always set logtraffic all end That's a basic fwpolicy from a fortiOS cli. If you need DNAT or security-profiles or SNAT, more configuration would be required

xsilver_FTNT

Staff

As emnoc pointed out, if 'inbound' mean DNAT, then keyword to look for is VIP (virtual IP).

Any connection through the firewall is governed by firewall or proxy policy, any connection to the firewall itself is goverened by trusted hosts, per port allowed services (allow access) and optionally via inbound policies.

For the sources I would suggest to start on http://docs.fortinet.com and check for guides per feature or technology, or check the cookbooks for pre-fabricated solutions and guides per desired outcom, config, design.

Basic solutions like VPN (SSL, IPSec or even L2TP) or VIP should be well documented in many variants and FortiOS version (be aware that there might be differences in config style between FortiOS Major/Minor versions).

Sign up

Login with SSO

Login to the community

Login with SSO