Can't view IP DVR from WAN - Fortigate 60C

[vorak]

Hi!

Today I'm facing a problem with a FortiGate 60C in transparent mode placed between a Cisco RV320 router and a Cisco SG200-26 L2 switch. I have an IP DVR connected to the switch and want to view live cameras from outside. Port forwarding is set at the router as well as DDNS.

When I set up the device in our cam viewer software using DDNS, it appears as connected and available but when I try to view live cameras, video isn't showing at all and get an "device is offline" error although the device appears as connected at the device list. If I try to view recorded video or remote config from the DVR I can do it. Seems that problem is only when trying to view live.

I've added the used port (8003) as a service under objects at the Policy & Objects config page an also I've set the IPv4 policy from internal to WAN to allow but still no luck.

If I connect IP DVR outside FortiGate but still under RV320, remote access/view is working fine.

Find attached a couple of screenshots with RV320 and FortiGate configuration.

Hope you can help. Regards.

[vorak]

rwpatterson wrote:

I stand corrected. I missed the transparent piece.

Alright, I think that transparent mode exists to avoid messing with ports and network config, so why is DVR remote traffic passing partially? Is the 8003 port being blocked? Is something that Im missing?

[ericli_FTNT]

If you want to avoid NAT in your network, how about PAT?

A TP firewall is a layer-2 device. You can't configure NAT (layer-3) or PAT (layer-4) on it.

[vorak]

ericli wrote:

If you want to avoid NAT in your network, how about PAT?

A TP firewall is a layer-2 device. You can't configure NAT (layer-3) or PAT (layer-4) on it.

Port Address Translation is a configuration set up under NAT, so I'm going to discard it as an option.

Why is FortiGate blocking only the live view? I tried disabling av, web filter, application control from policy with no luck, I think I'm not going anywhere to solve this.

[ericli_FTNT]

Hi，

Can you figure out "source ip, source port, destination ip, destination port" of the video traffic? If so, we could try to get debug information.

[vorak]

ericli wrote:

Hi，

Can you figure out "source ip, source port, destination ip, destination port" of the video traffic? If so, we could try to get debug information.

Thanks ericli, here is the info you requested:

Source IP: Any

Source Port: 8003

Destination IP: 192.168.2.3 (public is dynamic resolved by DDNS)

Destination Port: 8003

Hope this can come in handy.

Now I've set up a VPN tunnel on my RV320, when connecting, either PPTP and IPSec (cisco group auth) allows me to watch live cameras, thought this info can be useful too.

Regards.

[ericli_FTNT]

please try these 3 commands and paste the output here, thanks!

diagnose debug enable
diagnose debug flow filter dport 8003
diagnose debug flow trace start 3