Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Not applicable

2 wan' s, admin and ssh acess problems

Hi, I have a FGT-80C and 2 wan' s interfaces. WAN1 = 200.200.200.200/28 WAN1= 100.100.100.100/28 This 2 interfaces are internet interfaces. My problem: From outside (internet) I can access admin GUI (https) only to WAN2 IP Address and ssh to WAN1. Both interfaces ar configures to allowaccess https ssh, but I just can connect http on wan2 and ssh on wan1. Thanks for any help
9 REPLIES 9
Carl_Wallmark
Valued Contributor

Hi, what static routes do you have ?

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
Not applicable

FGT80C # get router info routing-table static S* 0.0.0.0/0 [10/0] via 200.200.200.193, wan1, [5/50] [10/0] via 100.100.100.97, wan2, [10/50] S 192.168.10.0/24 [10/0] via 192.168.0.252, internal, [0/50]
Carl_Wallmark
Valued Contributor

You need to have a 0.0.0.0/0 for wan2 with the same distans as wan1, if your fortigate doesn´t know what ip you come from, it will answer through wan1, and those packets will be dropped.

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
Not applicable

But I ONLY can connect with SSH on WAN1. ADMIN GUI not. On WAN2, I can connect on ADMIN GUI and SSH.
Carl_Wallmark
Valued Contributor

have you enabled HTTP on the wan1 interface ?

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
Not applicable

No. Just HTTPS and SSH in both interfaces.
Carl_Wallmark
Valued Contributor

try to enable HTTP, and check if that works

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
Not applicable

Hi, Selective. I solved my problem. The problem was VIP using port 443. So I change Admin HTTPS to 4443 and works fine. Thank' s
Carl_Wallmark
Valued Contributor

glad to hear !

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors