Technical Tip: Configuring Hairpin NAT (VIP) in policy route

[subramanis]

Description

This article describes how to configure FortiGate for Hairpin NAT for the internal network to access the VIP when the policy route is configured over a different VIP external interface.

Scope

FortiGate.

Diagram.

Load balancer:

config firewall vip

    edit "Test-VIP"

        set uuid f3f77000-cec4-51eb-a69d-9b6116986fc3

        set type server-load-balance

        set extip 192.168.1.100

        set extintf "port2"

        set server-type http

        set monitor "healthcheck"

        set extport 80

                config realservers

                           edit 1

                set ip 172.16.0.2

                set port 80

The VIP is configured on the primary internet link but all traffic coming from the LAN 10.0.0.0/24 is routed using Policy route over WAN2.

Interface Configuration:

Fw1 # show system interface port2  
config system interface
    edit "port2"
        set vdom "root"
        set ip 192.168.1.1 255.255.255.0
        set allowaccess ping
        set type physical
        set alias "wan1"
        set snmp-index 2
    next
end

Fw1 # show system interface port3  
config system interface
    edit "port3"
        set vdom "root"
        set ip 192.168.2.1 255.255.255.0
        set allowaccess ping
        set type physical
        set alias "wan2"
        set snmp-index 3
    next
end

Fw1 # show system interface port4
config system interface
    edit "port4"
        set vdom "root"
        set ip 10.0.0.1 255.255.255.0
        set allowaccess ping
        set type physical
        set snmp-index 4
    next
end

Fw1 # show system interface port5
config system interface
    edit "port5"
        set vdom "root"
        set ip 172.16.0.1 255.255.255.0
        set allowaccess ping
        set type physical
        set snmp-index 5
    next
end

Policy route from LAN 10.0.0.0/24 internet over WAN2:

Fw1 # show router policy
    edit 1
        set input-device "port4"
        set src "10.0.0.0/255.255.255.0"
        set dstaddr "all"
        set gateway 192.168.2.2
        set output-device "port3"
    next
end

Firewall policy from WAN1 to VIP:

Fw1 # show firewall policy
config firewall policy
    edit 1
        set name "vip"
        set uuid d7b467a8-cec5-51eb-5f31-55cc9964d349
        set srcintf "port2"
        set dstintf "port5"
        set srcaddr "all"
        set dstaddr "Test-VIP"
        set action accept
        set schedule "always"
        set service "HTTP"
        set inspection-mode proxy
    next

Firewall policy from LAN to VIP:

Fw1 # show firewall policy

    edit 2

         set name "lan_to_vip"

         set uuid 4ef186ca-cec6-51eb-5395-e482928e6b56

         set srcintf "port4"

         set dstintf "port2"

         set srcaddr "Lan_10.0.0.0_24"

         set dstaddr "VIP_192.168.1.100"

         set action access

         set schedule "always"

         set service "ALL"

    next

end

Debug Flow:

Fw1 # id=20085 trace_id=1 func=print_pkt_detail line=5700 msg="vd-root:0 received a packet(proto=6, 10.0.0.2:54494->192.168.1.100:80) from port4. flag [S], seq 324277149, ack 0, win 64240"
id=20085 trace_id=1 func=init_ip_session_common line=5871 msg="allocate a new session-00000860"
id=20085 trace_id=1 func=fw_pre_route_handler line=182 msg="VIP-172.16.0.2:80, outdev-unknown"
id=20085 trace_id=1 func=__ip_session_run_tuple line=3492 msg="DNAT 192.168.1.100:80->172.16.0.2:80"
id=20085 trace_id=1 func=vf_ip_route_input_common line=2566 msg="Match policy routing id=1: to 192.168.2.2 via ifindex-5"
id=20085 trace_id=1 func=vf_ip_route_input_common line=2584 msg="find a route: flag=04000000 gw-192.168.2.2 via port3"
id=20085 trace_id=1 func=fw_forward_handler line=640 msg="Denied by forward policy check (policy 0)"
id=20085 trace_id=2 func=print_pkt_detail line=5700 msg="vd-root:0 received a packet(proto=6, 10.0.0.2:54494->192.168.1.100:80) from port4. flag [S], seq 324277149, ack 0, win 64240"

Solution

STOP the policy route from the LAN to the Real server.

Fw1 # show router policy
config router policy
    edit 2
        set input-device "port4"
        set srcaddr "Lan_10.0.0.0_24"
        set dst "172.16.0.2/255.255.255.255"
        set action deny
        set status enable
    next

id=20085 trace_id=6 func=print_pkt_detail line=5700 msg="vd-root:0 received a packet(proto=6, 10.0.0.2:54495->192.168.1.100:80) from port4. flag [S], seq 4123342479, ack 0, win 64240"
id=20085 trace_id=6 func=init_ip_session_common line=5871 msg="allocate a new session-0000096a"
id=20085 trace_id=6 func=fw_pre_route_handler line=182 msg="VIP-172.16.0.2:80, outdev-unknown"
id=20085 trace_id=6 func=__ip_session_run_tuple line=3492 msg="DNAT 192.168.1.100:80->172.16.0.2:80"
id=20085 trace_id=6 func=vf_ip_route_input_common line=2584 msg="find a route: flag=04000000 gw-172.16.0.2 via port5"
id=20085 trace_id=6 func=fw_forward_handler line=796 msg="Allowed by Policy-1:"
id=20085 trace_id=6 func=ipd_post_route_handler line=490 msg="out port5 vwl_zone_id 0, state2 0x0, quality 0.

All the traffic from the LAN 10.0.0.0/24 routed over the WAN2 as per policy route except the VIP(192.168.1.100).

Related article:

Technical Tip: Configuring Hairpin NAT (VIP)