Skip to main content
Umesh
Umesh
Explorer II
March 21, 2022
Question

VIP configuration

  • March 21, 2022
  • 2 replies
  • 2215 views

Dear folks,

As I am trying to configure VIP in the FortiGate firewall but could not succeed in this lab. could you please see my configuration what I am doing a mistake for this lab.

Step 1. - I want to access the web server using telnet and ssh service from the outside world.

step 2.  I have mapped external IP and webserver IP in VIP option.

step 3. created policy such as -

incoming interface - WAN

outgoing interface - DMZvip topology.JPGvip1.JPGVIP policy_2.JPGVIP ping from pc 192.168.1.2.JPG

source address - all

destination address- web server ( virtual IP )

service - all

Nat -disabled

then I applied this policy and after applying unable to access the webserver from the outside.

 

Please find the screenshot that will be better for understanding what I doing in this lab.

 

 

 

2 replies

aahmadzada
Staff
aahmadzada
Staff
March 21, 2022

Hi Umesh,

 

In order to have an uderstanding how the Fortigate does handle the traffic, please run debug flow and packet sniffer as below:

Please run these debugging commands while connected to fortigate via two ssh sessions:
 
NOTE: SSH Session 1 and SSH Session 2 are separate simultaneous SSH connections.
It means that they must be running simultaneously. Otherwise, this gathered data will not be useful for troubleshooting
 
NOTE : Before running below mentioned commands, make sure that you capture console output to a file.
Please follow below link to capture the output in the text file with Putty:
a) SSH Session 1(Sniffer.txt):
diag sniffer packet any "host 10.1.1.1 or host 192.168.99.2" 6 0 l
 
b) SSH Session 2(Debug.txt):
diag debug reset
diag debug console timestamp enable
get router info routing-table all
get router info routing-table details
get router info routing-table database
get router info kernel
diag ip arp list
diag ip address list
diag ip rtcache list
diag debug flow filter clear
diag debug flow filter addr 10.1.1.1 192.168.99.2 or
diag debug flow trace start 10
diag debug enable
 
Run the above-mentioned commands and then try to connect to 192.168.99.2. After the connection attempt, stop the sniffer and debug.
 
To stop the debug, type:
diag debug disable
diag debug reset
diag debug flow trace stop
 
To stop the sniffer, press "CTRL + C".

 

Once done, attach the outputs to the thread

 

Ahmad

    Debbie_FTNT
    Staff & Editor
    Debbie_FTNT
    Staff & Editor
    March 21, 2022

    Hey Umesh,

    silly question:

    - your diagram shows WAN interface as 192.168.99.2, and external IP of VIP as 192.168.99.4

    - your VIP configuration shows external IP as 192.168.99.2

    Can you verify that you have the correct IPs set for interface and VIP?

    -> with the VIP configured as it is (no specific port filters), it needs to have a different external IP than the interface

     

    If this is not a simple error in external IP/interface IP, Ahmed has provided excellect debug commands to get started figuring out what's happening :)

      Terms & ConditionsAccessibility statement