Hi all,
I have a FW device (in Azure, but I don't think that's important):
Public IP: 120.120.120.120
External IP (port1): 192.168.1.1
Internal IP (port2): 192.168.1.2
The public IP is natted to the external ip. Both interfaces have HTTPS access enabled, so I can get into the web console on via public IP usually.
There's a site to site VPN, for which there's a static route for all remote site traffic (e.g. static route for 10.2.0.0/255.255.0.0 goes to device VPN1). If I'm on a client computer on the 10.2.0.0 network (e.g 10.2.0.1) and the VPN is up I can no longer get to HTTPS on the public IP (120.120.120.120), I can on the internal interface address (192.168.1.2) as you'd expect.
Pretty sure this is a routing issue. Put a static route in for 10.2.0.1/32 out of port1 and I can once again hit that HTTPS on the public IP, or drop the VPN and again it works. So I figured I'd put a policy route in for anything on 443 with a source address of 192.168.1.1 to go out of port1. However this doesn't seem to work....at all, I think it's still trying to shove it down the VPN. A colleague mentioned that he would expect to have to set somewhere to say to apply that policy route to traffic originating from "self" or similar, but all the Fortinet gives me is a list of ports or VPNs.
Am I missing something here?
Cheers,
Luke
