Hello guys i have a fortigate 100d. I think it is a simple deal but i wanted to confirm either way. I have a phone system that is receiving sip traffic for telco. This telco system was connected directly to the net with a public address. I wanted to bring the phone system behind the firewall and nat all traffic to it. Please let me know if this is the right way to do it
FG100d
7.7.7.7 255.255.255.252
telco
7.7.7.8 255.255.255.252
First i would setup a vip like so External IP Address/Range 7.7.7.8-7.7.7.8 with a mapped internal address to 192.168.1.5-192.168.1.5
config firewall vip edit "Cisco-SIP" set extip 7.7.7.8 set extintf "wan1" set mappedip "192.168.1.5-192.168.1.5" next
edit 4 set srcintf "wan1" set dstintf "lan" set srcaddr "all" set dstaddr "Cisco-SIP" set action accept set schedule "always" set service "Cisco-Phones" next
FGT100D # show firewall service custom config firewall service custom
edit "Cisco-Phones" set category "VoIP, Messaging & Other Applications" set tcp-portrange 5090:0-65535 5000:0-65535 set udp-portrange 9000-9049:0-65535 5060:0-65535 5090:0-65535 next
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Looks good from here. You'll need one additional policy for outgoing traffic from the phone switch. Not sure how well the SIP helper has matured, but you may need to muck with that as well. (muck as in delete...)
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
good call on the sip helper i am going to disable it right now.
Also shouldn't the normal outbound policy take care of it?
set srcintf "lan" set dstintf "wan1" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set utm-status enable set av-profile "AV" set ips-sensor "IPS" set profile-protocol-options "default" set ssl-ssh-profile "certificate-inspection" set nat enable
I'm not going assume your outbound policy is wide open (all to all). Just covering all bases. My outbound is heavily filtered. SIP would probably break with IPS and web filtering and such...
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
Cool thank you for your help. All great ideas!
Your VIP will NAT the inbound traffic, but the outbound traffic will always use the WAN interface IP.
If you want to use the IP 7.7.7.8 for your PBX, you will need add the "nat-source-vip enable" on your NAT :
config firewall vip edit "Cisco-SIP" set extip 7.7.7.8 set extintf "wan1" set mappedip "192.168.1.5-192.168.1.5"
set nat-source-vip enable next
Lucas
Lucas that is another great thought, Thank You.
When making this change i don't see it reflect in the GUI.
is this something that normally does not show up?
There are several CLI only options. This appears to be one of them.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
This is not quite correct I'm afraid.
The option "nat-source-vip" prevents the reverse NAT (source NAT) of outgoing traffic from hosts which are not specified explictely in the VIP definition.
This implies (and is indeed the case) that a VIP definition alone will not only translate the destination address on incoming traffic but will also translate the source address in the reply traffic to the external IP address specified in the VIP. In former versions of FortiOS this had to be done manually by defining an IP pool for source NATting. At least from v4.3 on the VIP will take care of this.
As an example: in the DMZ (with 10.11.12.0/24) you've got a server 10.11.12.1. You want to make this server reachable via the public address 1.2.3.4. You create a VIP "ext2server" like this:
name "ext2server"
external address: 1.2.3.4
mapped to: 10.11.12.1
port forwarding: disabled
To put the VIP into effect you use it in a policy:
source interface: wan1
source address: any
dest interface: dmz
dest address: ext2server
service: ALL
action: accept
Now external traffic can reach the server located in the dmz as the destination address is translated from 1.2.3.4 to 10.11.12.1 . When the server responds, it's source address (which in reality is 10.11.12.1) is translated to 1.2.3.4 so that for the external host the whole NAT is transparent.
Now for the "nat-source-vip" parameter.
Enabling or disabling it will have no effect for the scenario given above, i.e. traffic to and from the intended host. But, if there is another host in the DMZ, it's source address is either the real address (if "nat-source-vip" is disabled) or the 'official' virtual IP address specified in the VIP (if "nat-source-vip" is enabled). Use this if your intention is to cloak or hide the true address space of the DMZ hosts, without creating a lot of VIPs or IP pools, as long as at least one VIP exists.
anyone know if this is needed in v5.2.2 build 0642,141118 (ga)
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1710 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.