- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Allow my customer to manage his VIP
Hello,
We are hosting a client on our infrastructure and have set up VDOMs as follows:
We use FortiManager and have created an ADOM that contains the client's VDOM. The client can manage their firewall rules autonomously.
We have assigned them 10 public IPs and I would like them to be able to manage these autonomously as well. How should we proceed?
Thank you for your help!
Solved! Go to Solution.
- Labels:
-
FortiGate
-
FortiManager
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming root VDOM is under your control and VDOM1/2 under customer control, then in root you can simply route the 10 public IPs to the customer's VDOM, where they can deal with it however they like (VIP, IP pool, etc.)
- « Previous
-
- 1
- 2
- Next »
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your help, but unfortunately, it still doesn't work. You mentioned SNAT in your response; my VDOMs do not have "Central SNAT" enabled. Could this be an issue?
On my VDOM1, I see incoming packet, but on my source device, ping don't work/
HOSTNAME (VDOM1) # diag sniffer packet any 'icmp and src host 92.184.99.183' 4
interfaces=[any]
filters=[icmp and src host 92.184.99.183]
30.048388 VLAN_301 in 92.184.99.183 -> 1.2.3.4: icmp: echo request
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I missed to tell you about sdwan is enable, maybe there is an impact ?
In my log view, I see traffic incoming on interface. But in my rules, I can just check SDWan Zone, not interface. So traffic is blocked.
How can I do ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it looks like you don't have a matching firewall policy in the VDOM that owns VLAN_301 (is it root?).
You can run debug flow to check how it is evaluated:
diag debug flow filter clear
diag debug flow filter proto 1
diag debug flow addr <src-ip from which the ping comes>
diag debug enable
diag debug flow trace start 10
=> now try ping again
You can also show us the configuration of the policy you expect to be matched in root.
> my VDOMs do not have "Central SNAT" enabled. Could this be an issue?
Don't bother making changes to SNAT at this point, unless it proves to be required.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you again for your help
HOSTNAME (root) # id=65308 trace_id=4 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 92.184.99.180:36996->37.64.138.20:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=36996, seq=1."
id=65308 trace_id=4 func=init_ip_session_common line=6127 msg="allocate a new session-00f5c4fb"
id=65308 trace_id=4 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.2 via vlnk_HYP1"
id=65308 trace_id=4 func=__iprope_tree_check line=535 msg="gnum-100004, use addr/intf hash, len=3"
id=65308 trace_id=4 func=fw_forward_handler line=839 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=5 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 92.184.99.180:50108->37.64.138.20:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=50108, seq=1."
id=65308 trace_id=5 func=init_ip_session_common line=6127 msg="allocate a new session-00f5ca0e"
id=65308 trace_id=5 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.2 via vlnk_HYP1"
id=65308 trace_id=5 func=__iprope_tree_check line=535 msg="gnum-100004, use addr/intf hash, len=3"
id=65308 trace_id=5 func=fw_forward_handler line=839 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=6 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 92.184.99.180:26392->37.64.138.20:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=26392, seq=1."
id=65308 trace_id=6 func=init_ip_session_common line=6127 msg="allocate a new session-00f5d200"
id=65308 trace_id=6 func=__vf_ip_route_input_rcu line=1988 msg="find a route: flag=00000000 gw-10.0.0.2 via vlnk_HYP1"
id=65308 trace_id=6 func=__iprope_tree_check line=535 msg="gnum-100004, use addr/intf hash, len=3"
id=65308 trace_id=6 func=fw_forward_handler line=839 msg="Denied by forward policy check (policy 0)"
id=65308 trace_id=7 func=print_pkt_detail line=5942 msg="vd-root:0 received a packet(proto=1, 92.184.99.180:42823->37.64.138.20:2048) tun_id=0.0.0.0 from VLAN_301. type=8, code=0, id=42823, seq=1."
I missed to tell you about sdwan is enable, maybe there is an impact ?
In my log view, I see traffic incoming on interface. But in my rules, I can just check SDWan Zone, not interface. So traffic is blocked.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Debug flow reports this as traffic wanting to go in the direction: VLAN_301 -> vlnk_HYP1.
(the egress interface decided based on the routing table),
So you need a policy that covers these two interfaces as srcintf and dstintf, respectively, or zones that contain these interfaces.
Make sure the source/destination address and service (accepted protocols) options are also set to something that matches the traffic.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't know why, when I want to re-reun diagnose again, I haven't traffic...
diag debug flow filter clear
diag debug flow filter proto 1
diag debug flow addr <src-ip from which the ping comes>
diag debug enable
diag debug flow trace start 10
=> now try ping again
Do you have an idea why ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
All is good !
I did a mistake, I reversed source and destination in my rules.
Thank you for you patience pminarik !
- « Previous
-
- 1
- 2
- Next »