Skip to main content
inventohakk
inventohakk
New Member
August 21, 2024
Solved

ZTNA - Off-net

  • August 21, 2024
  • 2 replies
  • 5430 views

Hello, I need an urgent support

I am doing ztna configuration and fortiems on prem,

For off-net and on-net users, I created a record as fortiems.xxx.com for users in both local dns and global dns,

I created fortiems.xxx.com for off-net users, the dns record is in the same subnet as the wan ip but it is not a direct wan ip, I need to announce this ip behind the wan interface to get telemetry data, but I do not know how to do this, I entered the wan interface as the second ip, but it did not seem like a correct configuration, I cannot see it in the arp table.

Can you help me for this

 

Best answer by ozkanaltas

Hello @inventohakk ,

 

Can you try to enable the arp replay setting on the VIP configuration? 

 

config firewall vip     edit <name>         set arp-reply enable     next end

2 replies

AEK
SuperUser
AEK
SuperUser
August 21, 2024

Hello

You can do so by adding a VIP, listening on WAN interface and using secondary IP.

AEK
inventohakk
inventohakkAuthor
New Member
August 21, 2024

I created vip from secondary ip to local ems ips from secondary ip to local ems ips as 8013 and added second ip to wan interface but it did not happen, the second ip does not appear in the arp table.

ozkanaltas
ozkanaltas
Valued Contributor III
August 21, 2024

Hello @inventohakk ,

 

If I understand correctly, you want to reach out to EMS to get telemetry data from both inside and outside users.

 

If you say yes, firstly you need to create a VIP object on Fortigate. This VIP should redirect packets to your internal EMS server. Configuration should be like this. After that, you need to use this VIP object in the firewall policy.

 

image.png


After that, your client can reach your ems server from outside.

inventohakk
inventohakkAuthor
New Member
August 21, 2024

Hello.

You understood correctly, I created the vip in the way you showed, I used it in the rule,

The external ip I use in vip is in the same subnet as the wan ip address behind the wan interface, but it is not the direct internet output ip, I added it as a second ip later because I could not find a solution.

ozkanaltas
ozkanaltasAnswer
Valued Contributor III
August 21, 2024

Hello @inventohakk ,

 

Can you try to enable the arp replay setting on the VIP configuration? 

 

config firewall vip     edit <name>         set arp-reply enable     next end
Terms & ConditionsAccessibility statement