FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Hassan09
Staff
Staff
Article Id 262266
Description This article describes that when deploying a FortiGate virtual machine (VM) on a public cloud platform such as AWS, Azure, GCP, or OCI, and configuring a virtual server in the firewall policy, there is a specific behavior to be aware of.
Scope FortiGate VM in Public cloud.
Solution

When a client behind FortiGate port2 attempts to communicate with a server behind FortiGate, the packet always uses the IP address of the FortiGate interface port2 as the source IP. This default behavior prevents the server from being able to identify the actual source IP of the traffic.

However, in certain scenarios, it may be necessary to preserve the original IP address.


The FortiGate VM is deployed in either active/passive mode or a standalone configuration.
Both the servers and clients have traffic routed to the FortiGate Network Virtual Appliance (NVA) port2 as the next hop, utilizing Azure User-Defined Routing (UDR).


The firewall policy responsible for inspecting traffic on port2 has the virtual server configured as the destination, with SNAT (Source Network Address Translation) disabled.


Clients communicate with the server by directing their traffic to port2, with the assistance of UDR.
The traffic matches the virtual server, where DNAT (Destination Network Address Translation) translates the virtual server IP to the real server IP.


The packet is then SNATed with the IP of port2 and forwarded to the server.
Upon reaching the server, it will only see the IP address of the FortiGate port2 instead of the original IP address of the client.


This behavior is expected because the traffic is ingressing and egressing on the same interface (port2), creating a hairpin scenario where SNAT is performed by default.

 

To allow the server to see the original IP address of the packet, the snat-hairpin-traffic feature needs to be disabled. This can be achieved by following the steps below:

 

config system settings
    set snat-hairpin-traffic disable
end


By disabling the snat-hairpin-traffic feature, the server behind the FortiGate will now be able to correctly identify the original IP address of the client when receiving traffic through the virtual server.