Skip to main content
abood
abood
New Member
May 25, 2016
Question

Virtual IP with port forwarding

  • May 25, 2016
  • 2 replies
  • 8737 views

Hello,

I have a strange issue regarding the Virtual IP with port forwarding:

i have fortios: 5.4

Type: Static NAT

External IP Address/Range: x.x.x.x - x.x.x.x

Mapped IP Address/Range: 192.168.100.15 - 192.168.100.15

port forwarding:

Protocol: TCP

External Service Port: 25- 25

Map to Port: 25 - 25

 

And i configured the policy as required:

Source: any

destination: VirtualIP_name

service: smtp

now, when i try to test from any public PC to telnet x.x.x.x 25 it is failed.

the strange issue is that when i changed the External Service Port: 25- 25 to

External Service Port: 255- 255

and test from the public PC to telnet x.x.x.x 255 it is success and i can see the the server SMTP output?!!!

any help or suggestions?

    2 replies

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    May 26, 2016

    hi,

     

    and welcome to the forums.

    I would think that some other policy higher up in sequence is catching the SMTP traffic.

     

    You stated the policy settings but did not mention the interfaces involved. Hopefully, you do not use the 'any' interface but the specific interface for LAN (e.g. 'internal') and WAN (e.g. 'wan1'). Both in the policy and the VIP definition. Debugging 'any' interface objects can be very hard.

    abood
    aboodAuthor
    New Member
    May 26, 2016

    Hello and thank you for your help.

    the problem is solved, i was trying to telnet x.x.x.x 25 from two of my local ISPs and they blocked this port, so, i tried to use online telnet tool from the internet to x.x.x.x 25 and is succeeded.

     

    I have another question if you please: is there any limitation if we have use and enable the virtual IP through WAN1 (ISP1) and activate the WAN link load balancing

    Many thanks for your help

     

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    May 26, 2016

    I don't think so but...I seldomly use WLLB. My impression is that the WLLB is a kind of wrap around ECMP, together with grouping the WAN interfaces into a zone. To my dismay, you cannot use all features of an interface for a zone; if you can use all features of an interface with WLLB virtual interface, I'm not sure.

    Luckily, you can test that easily. Set up a WLLB (even on 2 unused ports) and try to define a VIP on the virtual port. It would be nice if you test this to post back your findings.

    abood
    aboodAuthor
    New Member
    May 27, 2016

    Hello all,

    I have tested the Virtual IP with WLB and everything works fine as expected.

    thank you all.

    Terms & ConditionsAccessibility statement