Skip to main content
FredMB
New Member
April 13, 2016
Question

Virtual Server not working on FortiWifi 51E 5.4

  • April 13, 2016
  • 1 reply
  • 7303 views

Hi,

 

We are actually testing Fortinet to replace our router and I can't make the Virtual Server working.

 

I have two interfaces : a WAN interface (wan1) and a Lan interface (internal).

 

If I create a Virtual IP (not Virtual Server) from WAN to LAN, it works fine, I can access my internal server from outside.

 

But when I want to use a Virtual Server (configured through the web interface), nothing happens : I have no error message, I can't access my server from outside, and there is nothing in Monitor / Load Balance Monitor.

 

I used, as specified, a different IP on the wan interface than the one configured as primary wan ip. This IP is correctly routed because it works fine with a Virtual IP.

 

Here is my configuration : 

 

config firewall vip
edit "vs-http"
set uuid 52b2575e-00c1-51e6-44ca-70e4e2d77d83
set type server-load-balance
set extip 37.xxx.xxx.222
set extintf "wan1"
set server-type http
set monitor "vs-ping"
set ldb-method round-robin
set extport 8082
config realservers
edit 1
set ip 192.168.200.3
set port 80
next
end
next
end

 

And here is the associated policy : 

config firewall policy
edit 4
set name "vs-http"
 set uuid 810e4f8e-00be-51e6-1949-2249a6106602
set srcintf "wan1"
set dstintf "internal"
set srcaddr "all"
set dstaddr "vs-http"
set action accept
set schedule "always"
set service "HTTP"
set logtraffic all
set nat enable
set fixedport enable
next
end

 

Also, I can't select HTTPS for Server Type as it doesn't appear in the list. I don't know if both problems are linked or not.

 

Do you have any idea on how to solve this problem ?

 

Thank you for your help,

 

Fred

    1 reply

    ede_pfau
    SuperUser
    SuperUser
    April 13, 2016

    hi,

     

    and welcome to the forums.

     

    In your policy, why do you set "fixedport enable"? This will prevent more than one session across this policy which is probably not what you intend.

    Additionally, I would not enable NAT - this will make your server "blind" to where the requests are coming from. This "NAT" setting will do source address NAT, replacing the original source IP with the interface's IP. Of course, the server then needs a default route pointing back to the FGT.

    FredMB
    FredMBAuthor
    New Member
    April 13, 2016

    Hi,

     

    Thank you for your reply.

    The fixedport option was set during one of my trials to make virtual servers to work. Even when it's off, the virtual server is not listed in the monitoring page.

     

    For the NAT option, it is explicitly specified in the documentation to turn it on (http://docs.fortinet.com/uploaded/files/2770/fortigate-load-balancing-54.pdf).

     

    What I don't understand is why my Virtual Server doesn't appear in th emonitoring page. Even with routing problems it should be visible, no ?

     

    Fred

    Carl_Wallmark
    New Member
    April 13, 2016

    Hi,

     

    One thing I can see is that you have specified external port 8082, but the firewall policy only allow HTTP (port 80).

    Create a service with 8082 and apply that to your firewall policy.