VIP Hairpin access from LAN

Forum|Forum|2 years ago
October 18, 2023
4 replies
2994 views

Maybe someone can help me with this.

I’m trying to give access to VIP from internal LAN (VIP hairpin access) and I don’t know why it’s not working.

When I try to go on external IP, fortigate keeps blocking traffic in policy Implicit deny

Fortigate 81e on 7.2.5 fortios

WAN1 : x.x.x.x (WAN1 in SD-WAN Zone)

Computer: 10.10.70.69 (type VLAN: VLAN70 on physical port 1)

Server: 10.10.0.8 (Physical port 2)

VIP=

FortiGate

Hong_FTNT

Staff & Editor

Hi @philbud,

The VIP is correct. However, your policy is wrong. You need 2 firewall policies. One to allow VLAN70 to virtual-wan-link, another one to allow virtual-wan-link to port2 (only use VIP in this policy as destination). Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-Hairpin-NAT-VIP/ta-p/195448

Regards,

philbudAuthor

Explorer

Thanks for response...

Yes sorry I forgot to mention it but I do have a policy from virtual-wan-link to port2 already there but like i said it's not working. Do you see anything else?

Hong_FTNT

Staff & Editor

@philbud,

Do you have a policy to allow VLAN70 to virtual-wan-link? If yes, make sure the destination is set to all and NAT is enabled. If it still not working, you can run a debug flow by following this article: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connectivity/ta-p/192560

Regards,