Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Krich124
New Contributor

Allow Inbound access to device on 2nd WAN

We have a host in a VLAN that needs to be openly accessed by an outside provider through a 2nd WAN port. We've followed Fortinet documentation on port forwarding and 1:1 NAT but we aren't able to ping the host. The configuration is as follows:

 

We have a default route to our primary WAN on port 1 with a static public IP x.x.x.200. We have a 2nd WAN connection on port 18 with a static public IP of x.x.x.199. We have an internal VLAN (DMZ) with a gateway of 10.200.80.1 and a host at 10.200.80.2. We need any traffic hitting our 2nd WAN (x.x.x.199) to be forwarded to the 10.200.80.2 host.

We have a a virtual IP configured to map the 2nd WAN to 10.200.80.2 (x.x.x.199 -> 10.200.80.2). We also have firewall policy stating [ SRC INT: WAN2 - DST INT: DMZ  SRC: Any - DST: VIP (x.x.x.199 -> 10.200.80.2) SERVICE: ALL  NAT: Dynamic IP Pool (One-One, x.x.x.199) Preserve Source Port  ]

 

We aren't able to ping the host or pass any traffic to 10.200.80.2 when we hit x.x.x.199.

1 Solution
gfleming
Staff
Staff

OK so you are using different VRFs... that is key information here.

 

Is the DMZ interface in VRF 1 or 0?

 

Why are you using VRFs?

 

Why are both your WAN IPs in the same subnet? Are they actually different circuits or is it a single shared circuit that you are trying to use differetn IP addresses on?

 

If it's the latter, you do not need to use multiple interfaces. Just have your primary WAN interface with IP address X. Then use VIPs for the other public IP addresses you own. They will enable ARP on the WAN interface to respond to those other IP addresses.

Cheers,
Graham

View solution in original post

15 REPLIES 15
Muhammad_Haiqal

Hi @Krich124 ,

Looking at the information provided, i believe there are no static route for WAN2.
0.0.0.0/0 GW WAN1 Distance 1 Priority 0

0.0.0.0/0 GW WAN2 Distance 1 Priority 5 << you are missing this.

If traffic coming from WAN2, the fortigate respond back using WAN1 which cause "reverse path check failed".

Creating a default route for the WAN2 basically will resolved the routing issue.

The rest, please configure VIP and Policy accordingly.

haiqal
Krich124

Here is the routing I have configured for both WAN ports. The WAN IPs are in the same subnet thus have the same GW. 

FW2# get router info routing-table static
Routing table for VRF=0
S* 0.0.0.0/0 [5/0] via x.x.x.185, port17, [2/0]

Routing table for VRF=1
S* 0.0.0.0/0 [10/0] via x.x.x.185, port18, [5/0]

Muhammad_Haiqal

Hi @Krich124 ,

Thank you for the respond.
Please make sure the distance is same. Priority is different between that WAN1 and WAN2.


Make sure you can ping WAN2 interface itself 1st. Then the VIP should be working. 

haiqal
Muhammad_Haiqal

I noticed you have VRF.  I believe you have only 1 ISP. But connect to 2 physical port at the Fortigate. You just need to use 1 port only: Example WAN1. and create the VIP.

 

Example:
WAN1: 212.11.23.109 

 

VIP configuration:

212.11.23.109 to 192.168.1.9

212.11.23.110 to 192.168.1.10

212.11.23.111 to 192.168.1.11
Assuming your have many public IP available.

Hope that helps. :)

 

 

haiqal
gfleming
Staff
Staff

OK so you are using different VRFs... that is key information here.

 

Is the DMZ interface in VRF 1 or 0?

 

Why are you using VRFs?

 

Why are both your WAN IPs in the same subnet? Are they actually different circuits or is it a single shared circuit that you are trying to use differetn IP addresses on?

 

If it's the latter, you do not need to use multiple interfaces. Just have your primary WAN interface with IP address X. Then use VIPs for the other public IP addresses you own. They will enable ARP on the WAN interface to respond to those other IP addresses.

Cheers,
Graham
Krich124

Thank you Graham. I'm not sure where the multiple VRFs came into play. I have added the 2nd IP to the primary WAN and I am able to see ICMP traffic coming inbound to the device.

Labels
Top Kudoed Authors