Description | This article describes that when deploying a FortiGate virtual machine (VM) on a public cloud platform such as AWS, Azure, GCP, or OCI, and configuring a virtual server in the firewall policy, there is a specific behavior to be aware of. |
Scope | FortiGate VM in Public cloud. |
Solution |
When a client behind FortiGate port2 attempts to communicate with a server behind FortiGate, the packet always uses the IP address of the FortiGate interface port2 as the source IP. This default behavior prevents the server from being able to identify the actual source IP of the traffic. However, in certain scenarios, it may be necessary to preserve the original IP address.
To allow the server to see the original IP address of the packet, the snat-hairpin-traffic feature needs to be disabled. This can be achieved by following the steps below:
config system settings
|
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.