Skip to main content
fsv99er
fsv99er
New Member
June 4, 2014
Question

unreachable wan ip adress from internal lan

  • June 4, 2014
  • 14 replies
  • 16432 views
Hy, Since a few weeks we have a fortigate 100D. Everything worked very fine. But now we have a big Problem. We have a WAN Ip Adress 212.xxx.xxx.xxx. This IP is reachable from the Internet. All works fine. But if my Device has an internel LAN IP Adress 192.xxx.xxx.xxx we cant reach the WAN IP Adress. What can i do that the WAN IP adress ist reachable from the LAN ? Is this a routing Problem ?

    14 replies

    Show previous replies
    fsv99er
    fsv99erAuthor
    New Member
    June 4, 2014
    hy, 212.xxx.xxx.xxx is the external ip sh firewall policy config firewall policy edit 3 set srcintf " mobilvpn" set dstintf " lan" set srcaddr " VPN_Range" set dstaddr " Internal_Range" set action accept set schedule " always" set service " ALL" set nat enable next edit 4 set srcintf " lan" set dstintf " mobilvpn" set srcaddr " Internal_Range" set dstaddr " VPN_Range" set action accept set schedule " always" set service " ALL" set nat enable next edit 6 set srcintf " lan" set dstintf " wan1" sh firewall vip config firewall vip edit " OWA" set extip 212.xxx.xxx.xxx set extintf " any" set portforward enable set mappedip 192.168.0.9 set extport 443 set mappedport 443 next edit " Port01 TCP" set extip 212.xxx.xxx.xxx set extintf " any" set portforward enable set mappedip 192.168.0.12 set extport 8080 set mappedport 8080 next edit " Port02 TCP" set extip 212.xxx.xxx.xxx set extintf " any" set portforward enable set mappedip 192.168.0.12 set extport 8050 set mappedport 8050 --More-- next --More-- edit " Port03 TCP" set extip 212.xxx.xxx.xxx set extintf " any" set portforward enable set mappedip 192.168.0.12 set extport 3232 set mappedport 3232 next end
    TheJaeene
    TheJaeene
    New Member
    June 4, 2014
    Try a " lan -> lan" fw policy that allows " any" since you bound the vip to " any" interface (seems that the Output of policy #6 is truncated
    TheJaeene
    TheJaeene
    New Member
    June 4, 2014
    My Last post was confusing... Need to grab some eat.. Create a policy from LAN to LAN allowing all Services to all destinations...
    fsv99er
    fsv99erAuthor
    New Member
    June 4, 2014
    Big big thanks for your help ! Now i can reach my external ip from a internal ip But not with the LAN to LAN with all services. I create a police from Lan to Lan with the VIP as Destination
    emnoc
    emnoc
    New Member
    June 4, 2014
    Suggestions:
    But not with the LAN to LAN with all services.
    Use diag debug flow with the correct filters, post the output of that diagnostic flow trace checking ordering of fwpolicies checking if SNAT is required or not
    Terms & ConditionsAccessibility statement