Access / routing from Wan1 to Wan2

[mapapo]

Hi, me again, A second interesting problem.We have to external Connections over different ISPs. Our Webserver uses WAN1 for incoming traffic. Our Users use WAN2 for Web-Surfing. Everything works fine but If users want to reach our Webserver it doesnt work, It seems that the " Internal Routing" for the outgoing connection on WAN2 to WAN1 somehow fails. Is there a policy I have to add for that case, or a route ? I am using MR06 Many thanks

[romanr]

Do you use Policy-Routing? Sounds like you force your web-users to wan2, but then you also maybe force " web-users to your-web-server" to wan2 which isn' t there!

[mapapo]

Basically yes, i use policy based routing. I thought the fortinet somehow can " reroute" traffic when its serves both IP-Adresses. I could make a route-policy for traffic going to our Internal Server but what should I enter? The external gateway as I have for the other rules for that IP though the traffic should stay somehow inside? Thanks

[mapapo]

I tried this now but somethings wrong. I have a rule allwoing my PC all traffic to wan2. I have a rule allowing my PC all traffic to wan1. (To be on the safe side) I have a virtual IP allwoing the inbound connection for the webserver and a static route for the webserver for wan1 I have a static route for my PC to go to the gateway on wan2 When I try to reach the Webserver (with his public IP which is the IP for the interface on wan1) The connection times out. I mad a static route for Traffic going to the Webserver-IP to go out on the WAN1-Gateway but this doesnt help. Is there something I forgot?

[mapapo]

BTW: I forgot to mention: Ping works, but http not.

[UkWizard]

Wouldnt you need an rule like so; Source Int: Internal Source IP: Lan (or your pc) Dest Int: Wan1 Dest IP: VIP NAME !!!! Service: any Nat disabled. I would expect that to work, as i wouldnt expect routing to come into play, as its purely internal routing that would be taking place, as to the fortinet, the VIP address would be a directly connected subnet.

[ejhardin]

If I understanding you correctly.. Your users on the LAN are not able to access your web server which is on your LAN correct?

[rwpatterson]

I had the exact same problem at the photo lab I do work at. The web server and clients are on the same LAN. I could browse the server with the local address, but not the public address. The following looks really strange and bound to failure, but it worked for me. I created the following policy: Source interface: wan1 Source IP: internal (LAN) subnet Destination interface: internal Destination IP: inside server(s) NAT box checked Service: whatever you need Give that a shot. Like I said, looks stooopid, but it saved my a$$. Good luck

[ejhardin]

The most secure and recommend solution is to configure a split dns. You should never loop back through a firewall. (not just fortigate but any firewall/Proxy) A user should not leave the firewalls public interface to come back into the internal network.

[romanr]

I cannot agree to this, because the user will NOT leave the firewalls public interface in the scenario bob mentioned! I often encounter this scenario (web-server internally, addressed via public ip)... And in most cases it is done via 2 implicit policies (which in the most cases are there) internal -> wan (nat checked) wan -> internal (whatever server via VIP) For the web-server the internal users will look like internet-users, because they use the nat-pool or adress from the firewall. Using split DNS can be a good answer to many questions in many situations, but makes a lot of work depending on the scenario... and is often just another point of a possible failure.... For the scenario described above: Remeber that a route policy will REALLY FORCE traffic as written in the route policy: A policy like.... source: internal (0.0.0.0/0) protocol: 6 port 80 route to: wan2 (whatever gateway, mainly 0.0.0.0) .... will really force ALL http traffic from internal to the wan2 gateway, even you have a dmz or other networks, that should use other routes!!!!