Troubleshooting Tip: How to resolve Blocked port detected by online Port Checker despite correct VIP configuration and firewall policy in FortiGate

[Oscar_Wee]

Description	This article describes how to resolve blocked ports by checking the port status of the internal server.
Scope	FortiGate v7.0.11 and above, v7.2.1 and above.
Solution	When using an online port checker, the port used for services of the internal server is indicated as blocked. To troubleshoot this : Ensure that the VIP is set to point to the internal server correctly. Ensure that services allowed for configured firewall policy for VIP is correct.    Ensure that the internal server’s port is set to open. (This step is NOT FortiGate's setting. Configure on the internal server). Verify by accessing the website of the internal server via public IP, it should display correctly. Example of problem: In this example, 111.111.111.111 is an external WAN IP and 10.10.10.10 is a mapped internal server IP. Visit https://portchecker.co/check-v0  (IP addresses are fictitious in the example). Use these CLI commands: config firewall vip (Vip is set correctly)     edit "SQL"         set extip 111.111.111.111         set extintf "port3"         set portforward enable            set mappedip 10.10.10.10         set extport 3306                    set mappedport 3306             next config firewall policy (firewall policy is set correctly)     edit 1         set srcintf "port3"         set dstintf "port4"         set srcaddr "all"         set dstaddr "SQL"         set action accept         set schedule "always"            set service "ALL"            set nat enable            next end Make sure the internal server’s port is set to open:     #Allow incoming TCP ports   TCP_IN = “20,21,80,443,3306” Visit 111.111.111.111 and a visual of the functioning page will be shown as the port is not blocked by the internal server.