Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
vorak
New Contributor

Can't view IP DVR from WAN - Fortigate 60C

Hi!

 

Today I'm facing a problem with a FortiGate 60C in transparent mode placed between a Cisco RV320 router and a Cisco SG200-26 L2 switch. I have an IP DVR connected to the switch and want to view live cameras from outside. Port forwarding is set at the router as well as DDNS.

 

When I set up the device in our cam viewer software using DDNS, it appears as connected and available but when I try to view live cameras, video isn't showing at all and get an "device is offline" error although the device appears as connected at the device list. If I try to view recorded video or remote config from the DVR I can do it. Seems that problem is only when trying to view live.

 

I've added the used port (8003) as a service under objects at the Policy & Objects config page an also I've set the IPv4 policy from internal to WAN to allow but still no luck.

 

If I connect IP DVR outside FortiGate but still under RV320, remote access/view is working fine.

 

Find attached a couple of screenshots with RV320 and FortiGate configuration.

 

Hope you can help. Regards.

15 REPLIES 15
vorak

rwpatterson wrote:

I stand corrected. I missed the transparent piece.

Alright, I think that transparent mode exists to avoid messing with ports and network config, so why is DVR remote traffic passing partially? Is the 8003 port being blocked? Is something that Im missing?

ericli_FTNT

If you want to avoid NAT in your network, how about PAT?

 

A TP firewall is a layer-2 device. You can't configure NAT (layer-3) or PAT (layer-4) on it.

vorak

ericli wrote:

If you want to avoid NAT in your network, how about PAT?

 

A TP firewall is a layer-2 device. You can't configure NAT (layer-3) or PAT (layer-4) on it.

Port Address Translation is a configuration set up under NAT, so I'm going to discard it as an option.

 

Why is FortiGate blocking only the live view? I tried disabling av, web filter, application control from policy with no luck, I think I'm not going anywhere to solve this.

ericli_FTNT

Hi,

Can you figure out "source ip, source port, destination ip, destination port" of the video traffic? If so, we could try to get debug information.

vorak

ericli wrote:

Hi,

Can you figure out "source ip, source port, destination ip, destination port" of the video traffic? If so, we could try to get debug information.

Thanks ericli, here is the info you requested:

 

Source IP: Any

Source Port: 8003

Destination IP: 192.168.2.3 (public is dynamic resolved by DDNS)

Destination Port: 8003

 

Hope this can come in handy.

 

Now I've set up a VPN tunnel on my RV320, when connecting, either PPTP and IPSec (cisco group auth) allows me to watch live cameras, thought this info can be useful too.

 

Regards.

ericli_FTNT

please try these 3 commands and paste the output here, thanks!

 

diagnose debug enable
diagnose debug flow filter dport 8003
diagnose debug flow trace start 3

 

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors