Hairpin NAT (NAT loopback) in NGFW mode

[GSGBen]

Hi,

Situation is standard DMZ: single WAN port forwarded to a server in a DMZ which is separate to the main lan subnet. Access externally works via this port, and access internally (via the separate lan subnet/interface) works via the original IP and port.

External source accessing [ExternalIP]:88->[InternalDMZIP]:80  [style="background-color: #000000;"]works fine[/style]

Internal (lan) source accessing [InternalDMZIP]:80 [style="background-color: #000000;"]works fine[/style]

But how do we configure hairpin NAT when using NGFW mode? I would be happy with either the internal or external IP, as long as the port changes. the command 'set match-vip enable' doesn't existing in NGFW mode now. I've also tried creating a new VIP and using it in the LAN rule, using the internal address to the same address with just the port changed, but this breaks external access as well, even with it not applied to a rule! I've tried not specifying the interface in the VIP and specifying the external IP instead, which works externally again but not internally. Rules were set to allow both original and translated services during testing to rule out rule issues.

set match-vip enable [style="background-color: #000000;"]doesn't exist[/style]

Internal (lan) source accessing [ExternalIP]:88->[InternalDMZIP]:80 [style="background-color: #000000;"]doesn't work[/style]

Internal (lan) source accessing [InternalDMZIP]:88->[InternalDMZIP]:80 [style="background-color: #000000;"]doesn't work[/style]

[style="background-color: #000000;"][style="background-color: #ffffff;"]Any of the above with an SNAT from lan to DMZ to use the interface IP [/style]doesn't work[/style]

So how do we configure hairpin NAT when using NGFW mode?

[emnoc]

try adding  to the vip in the cli

config firewall vip  <vip-name>

   set extintf "any"

 end 

[Toshi_Esumi]

You need internal->internal policy as well. See the cookbook:

https://cookbook.fortinet.com/configure-hair-pinning-fortigate/

[rwpatterson]

toshiesumi wrote:

You need internal->internal policy as well. See the cookbook:

https://cookbook.fortinet.com/configure-hair-pinning-fortigate/

Why? The server is in the DMZ... Perhaps you mean internal -> DMZ policy???

[Toshi_Esumi]

You're right.

[Ashik_Sheik]

Internal to DMZ ..Normal Policy will work as far as server is accessible from lan .

But If Internal users access external IP or FQDN registered outside , then you need hairpin method as mentioned by other members .