|
'srcintf-filter' and 'extintf' definitions in the VIP settings often bring confusion.
'extintf' is intended to be used as a WebGUI improvement tool.
Defining an interface as a value of extintf parameter will make sure that the FortiGate will do the DNAT translation based on the configured VIP object for traffic coming from the selected interface.
Example:
config firewall VIP
edit "VIP"
set extip 85.132.52.234
set extintf "wan1"
set mappedip "10.185.3.199"
next
With this configuration, that VIP will be available in the WebGUI for selection only if WAN1 is configured as a source interface.
extintf will not bind the VIP to the specific interface. That means that the VIP shown as an example above will accept connections from each and every interface.
srcintf-filter on the other hand will map the VIP to a specific wan interface, making sure that the VIP will accept connections coming from the port(s) that is defined as a value of srcintf-filter parameter. This is helpful when DNAT translation is only desired on a subset of interfaces since on the web GUI, the interface binding only allows for choosing either 'any' interface or one particular interface to apply the VIP object to:
config firewall VIP
edit "VIP"
set extip 85.132.52.234
set srcintf-filter wan1 [<interface-1> <interface-2> ... <interface-n>]
set mappedip "10.185.3.199"
next
srcintf-filter is helpful in the setup of failover IPSec tunnel with overlapping subnets to prevent creating separate IP pools and VIP objects for each IPsec tunnel.
If the plan is to create multiple VIPs with the same external IP, different mapped IPs, and different mapped Interfaces; use 'srcintf-filter' to map the VIP to a specific interface as below.
VIP 1:
edit "192.168.150.1-192.168.151.1 wan1_2_VIP-test"
set uuid 7b9dfb30-19bf-51ef-57a6-4bb00c9f5c07
set extip 192.168.150.1
set mappedip "192.168.151.1"
set extintf "wan1"
set srcintf-filter "wan1"
next
VIP 2:
edit "192.168.150.1-192.168.151.5 wan1_2_VIP-test"
set uuid e0db38fa-19bf-51ef-e5b7-de4f20f45894
set extip 192.168.150.1
set mappedip "192.168.151.5"
set extintf "Wan2 "
set srcintf-filter "Wan2 "
next
It is necessary to add the respective firewall policies which allow the traffic.
|
