Allow my customer to manage his VIP

[5q46n2te8jPWJY]

Hello,

We are hosting a client on our infrastructure and have set up VDOMs as follows:

We use FortiManager and have created an ADOM that contains the client's VDOM. The client can manage their firewall rules autonomously.

We have assigned them 10 public IPs and I would like them to be able to manage these autonomously as well. How should we proceed?

Thank you for your help!

[5q46n2te8jPWJY]

Thank you for your help, but unfortunately, it still doesn't work. You mentioned SNAT in your response; my VDOMs do not have "Central SNAT" enabled. Could this be an issue?

On my VDOM1, I see incoming packet, but on my source device, ping don't work/

HOSTNAME (VDOM1) # diag sniffer packet any 'icmp and src host 92.184.99.183' 4
interfaces=[any]
filters=[icmp and src host 92.184.99.183]
30.048388 VLAN_301 in 92.184.99.183 -> 1.2.3.4: icmp: echo request

[5q46n2te8jPWJY]

I missed to tell you about sdwan is enable, maybe there is an impact ?

In my log view, I see traffic incoming on interface. But in my rules, I can just check SDWan Zone, not interface. So traffic is blocked.

How can I do ?

[pminarik]

it looks like you don't have a matching firewall policy in the VDOM that owns VLAN_301 (is it root?).

You can run debug flow to check how it is evaluated:

diag debug flow filter clear

diag debug flow filter proto 1

diag debug flow addr <src-ip from which the ping comes>

diag debug enable

diag debug flow trace start 10

=> now try ping again

You can also show us the configuration of the policy you expect to be matched in root.

> my VDOMs do not have "Central SNAT" enabled. Could this be an issue?

Don't bother making changes to SNAT at this point, unless it proves to be required.

[5q46n2te8jPWJY]

Thank you again for your help

HOSTNAME (root) # id=65308 trace_id=4 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 92.184.99.180:36996->37.64.138.20:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=36996, seq=1."
id=65308 trace_id=4 func=init_ip_session_common line=6127 msg="allocate a new session-00f5c4fb"
id=65308 trace_id=4 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.2 via vlnk_HYP1"
id=65308 trace_id=4 func=__iprope_tree_check line=535 msg="gnum-100004, use addr/intf hash, len=3"
id=65308 trace_id=4 func=fw_forward_handler line=839 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=5 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 92.184.99.180:50108->37.64.138.20:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=50108, seq=1."
id=65308 trace_id=5 func=init_ip_session_common line=6127 msg="allocate a new session-00f5ca0e"
id=65308 trace_id=5 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.2 via vlnk_HYP1"
id=65308 trace_id=5 func=__iprope_tree_check line=535 msg="gnum-100004, use addr/intf hash, len=3"
id=65308 trace_id=5 func=fw_forward_handler line=839 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=6 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 92.184.99.180:26392->37.64.138.20:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=26392, seq=1."
id=65308 trace_id=6 func=init_ip_session_common line=6127 msg="allocate a new session-00f5d200"
id=65308 trace_id=6 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.2 via vlnk_HYP1"
id=65308 trace_id=6 func=__iprope_tree_check line=535 msg="gnum-100004, use addr/intf hash, len=3"
id=65308 trace_id=6 func=fw_forward_handler line=839 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=7 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 92.184.99.180:42823->37.64.138.20:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=42823, seq=1."

 

I missed to tell you about sdwan is enable, maybe there is an impact ?

In my log view, I see traffic incoming on interface. But in my rules, I can just check SDWan Zone, not interface. So traffic is blocked.

[pminarik]

Debug flow reports this as traffic wanting to go in the direction: VLAN_301 -> vlnk_HYP1.

(the egress interface decided based on the routing table),

So you need a policy that covers these two interfaces as srcintf and dstintf, respectively, or zones that contain these interfaces.

Make sure the source/destination address and service (accepted protocols) options are also set to something that matches the traffic.

[5q46n2te8jPWJY]

I don't know why, when I want to re-reun diagnose again, I haven't traffic...

diag debug flow filter clear

diag debug flow filter proto 1

diag debug flow addr <src-ip from which the ping comes>

diag debug enable

diag debug flow trace start 10

=> now try ping again

Do you have an idea why ?

[5q46n2te8jPWJY]

All is good ! 

I did a mistake, I reversed source and destination in my rules.

Thank you for you patience pminarik !