Description
This article describes how to control/change the FortiGate source IP for self-generated traffic.
At times, an upstream device (a FortiGate placed behind another Router / Firewall) accepts only traffic from a specific IP address.
In some cases, there may be a private IP configured in the FortiGate WAN interface as there is a upstream device.
Scope
FortiGate.
Solution
By default, the source IP is from the FortiGate egress interface.
For FortiGuard Services :
config system fortiguard
set port 8888
set source-ip 0.0.0.0 <----- Set the desired IP allowed in upstream.
set source-ip6 ::
end
For DNS Service:
config system dns
set primary 208.91.112.53
set secondary 208.91.112.52
set source-ip 0.0.0.0 <- Set the desired IP allowed in upstream.
end
For FortiManager Service:
config system central-management
set fmg-source-ip 0.0.0.0 <----- It should set its FortiGate interface IP.
end
For a RADIUS server when the servers are located in a remote location and reachable through an IPSec tunnel:
config user radius
edit "server_name"
set source-ip 0.0.0.0 <- Set the desired IP allowed in upstream.
end
For an LDAP server when the servers are located in a remote location and reachable through an IPSec tunnel.
config user ldap
edit "server_name"
set source-ip 0.0.0.0 <----- Set the desired IP allowed in upstream.
end
Note:
When FortiGate tries to reach the DNS server configured under DNS settings, the firewall checks the routing table and checks which way (interface) it should go to the DNS server and Firewall uses the IP address configured on the interface to the DNS server.
However, in some cases, for instance, if the DNS server is behind an IPsec tunnel then FortiGate cannot use the IP address of the IPsec tunnel because in general, it is 0.0.0.0 so the firewall cannot reach the DNS server so it is necessary to configure a source-ip under DNS settings to use different IP address instead of IPsec interface IP
From the web interface (GUI), it is also possible to configure these settings:
From here, it is possible to enable the services desired, and configure the Source IP, outgoing interface, and IP version (IPv4 or IPv6):
For a Security Fabric server when the root FortiGate are located in a remote location and reachable through an IPSec tunnel which does not have an IP address configured on the IPsec VPN interface a source IP is needed to be configured for both the root FortiGate and the Downstream FortiGate to join the Security Fabric.
config system csf
set source-ip x.x.x.x
end
To enable 'Local Out Routing' and get more detailed information: Technical Tip: Configure and edit the Local-out Routing (Source-IP) using GUI for self-originating t...
Related documents:
