Visitor III

Solved

VIP rule

10 replies
136 views

i have newly created VIP rule to publish local microsoft dynamic test server to the internet to access anywhere, but the vip rule not hit any packets.

attached the rule screenshot and policy, any help from the community team would be appreciated

FortiGate

ferozAnswer

Visitor III

is 168.149.70.32 the assigned IP addreess on WAN-1 or is it a secondary IP / routed subnet through it? this is wan-2 ip which inside the sdwan bundle.

make sure that webUI mgmt port / SSLVPN are not listening on port 443 for that IP , check using diagnose sys tcpsock | grep 443 to confirm that
ssl vpn also using the same port 443

if you create another VIP for another public port , does it work ? port 443 for sslvpn is different wan and vip rule applied on difference wan

funkylicious

SuperUser

is the subnet 192.168.102.0 reachable behind LAN/port23 i assume ?

also, i see that you are using the default zone for sdwan, virtual-wan-link for inbound traffic. as per the link below “ Do not use the SD-WAN zone as an interface in the VIP or as Incoming in the policy; use the physical WAN(s) instead. “

in the firewall rule instead of virtual-wan-link, use WAN-1 and then try again. another thing to make sure of, is that the management webUI port if enabled on WAN-1 to be different that 443 used in the VIP

"jack of all trades, master of none"

ferozAuthor

Visitor III

is the subnet 192.168.102.0 reachable behind LAN/port23 i assume ? Yes it is reachable to any pc on lan.

i see that you are using the default zone for sdwan, virtual-wan-link for inbound traffic. as per the link below “ Do not use the SD-WAN zone as an interface in the VIP or as Incoming in the policy; use the physical WAN(s) instead. “
the wan links are already bundled, can’t select specific one.

in the firewall rule instead of virtual-wan-link, use WAN-1 and the try again. another thing to make sure of, is that the management webUI port if enabled on WAN-1 to be different that 443 used in the VIP
still same the traffic not matching

funkylicious

SuperUser

i would suggest doing a debug flow capture and post the output here using the cli commands:

diagnose debug reset
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug flow filter saddr IP <----- Source IP

diagnose debug flow filter daddr IP <----- Destination IP

diagnose debug flow filter port 443
diagnose debug flow show function-name enable
diagnose debug flow trace start 1000
diagnose debug enable

and the run some tests from a hotspot / wifi or from somewhere in the Internet

and to stop:

diagnose debug disable

diagnose debug reset

L.E. ff there are no 'hits' on the VIP/Policy, check that the port is not in use by SSL-VPN/admin on that IP/port.

"jack of all trades, master of none"

ferozAuthor

Visitor III

it not generate any traffic

diagnose debug reset
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug flow filter saddr 192.168.102.2

diagnose debug flow filter daddr 168.149.70.32

diagnose debug flow filter port 443
diagnose debug flow show function-name enable
diagnose debug flow trace start 1000
diagnose debug enable

funkylicious

SuperUser

the source ip would need to a internet source address to better test it.

you can do a test from the phone using it’s mobile data or via ping.eu to check the port, but in this case you would need to remove the filter for source ip and capture all source towards the public ip

"jack of all trades, master of none"

ferozAuthor

Visitor III

the source address i given mobile public ip, but still same.

funkylicious

SuperUser

ok, let’s start from the beginning.

is 168.149.70.32 the assigned IP addreess on WAN-1 or is it a secondary IP / routed subnet through it?

make sure that webUI mgmt port / SSLVPN are not listening on port 443 for that IP , check using diagnose sys tcpsock | grep 443 to confirm that

is there another device that might block/filter the port 443 before reaching the FGT/VIP ? maybe as your ISP

if you create another VIP for another public port , does it work ?

do you have auxiliary-session enabled ? try disabling them and see if anything changes

"jack of all trades, master of none"

ferozAuthorAnswer

Visitor III

is 168.149.70.32 the assigned IP addreess on WAN-1 or is it a secondary IP / routed subnet through it? this is wan-2 ip which inside the sdwan bundle.

make sure that webUI mgmt port / SSLVPN are not listening on port 443 for that IP , check using diagnose sys tcpsock | grep 443 to confirm that
ssl vpn also using the same port 443

if you create another VIP for another public port , does it work ? port 443 for sslvpn is different wan and vip rule applied on difference wan

funkylicious

SuperUser

if that IP is assigned to WAN-2 , then you should NOT create the VIP using WAN-1 as the interface for it or just leave it as any.

SSLVPN need to either be moved to another port or change the public port of the VIP to an unused/free one.

"jack of all trades, master of none"

ferozAuthor

Visitor III

please check inbox

Sign up

Login with SSO

Login to the community

Login with SSO