Hello,
I just installed a new fortigate and for first time enabled "central NAT" from cli
I created a SNAT rule for each outgoing Internet connection and I think these rules are working because I can browse Internet
Now I want to forward the port TCP 81 to 10.1.1.234 because I need to access there from Internet.
I created the following "DNAT & Virtual IP":
Interface: lan (I dont know if this should be the source or destination interface, but I tested with each with no luck)
Source Interface Flter: disabled
External IP Address/Range: PublicIP
Mapped IP Address/Range: 10.1.1.234
Optional Filters: disabled
Port Forwarding: enabled
Protocol: TCP
External Service Port: 81
Map to Port: 81
I can connect from inside with "telnet 10.1.1.234 81" but I can not connect from outside with "telnet publicIP 81", so the "DNAT & Virtual IP" is not working
What is wrong?
Thanks in advance.
Regards,
Damián
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
do you have a policy to permit inbound connection to the VIP ? I suspect that's all you're missing...
The next thing I'll point you to is "diag debug flow". For example have a look at this page for inspiration https://marktugbo.com/2017/07/04/tools-flow-trace-in-fortigate/ but a simplistic version for you would be something like:
diag debug disable
diag debug flow filter daddr 10.1.1.234
diag debug flow filter port 81
diag debug flow show function-name enable
diag debug flow trace start 10
diag debug enable
... and then look at what info you get from there.
Hello people!
You were right, the traffic is being blocked by the implicit policy:
id=20085 trace_id=1 func=print_pkt_detail line=5573 msg="vd-root:0 received a packet(proto=6, SRCpublicIP:53495->WAN1IP:81) from wan. flag , seq 4175373843, ack 0, win 64240"
id=20085 trace_id=1 func=init_ip_session_common line=5744 msg="allocate a new session-01b345f2"
id=20085 trace_id=1 func=vf_ip_route_input_common line=2591 msg="find a route: flag=80000000 gw-WAN1IP via root"
id=20085 trace_id=1 func=fw_local_in_handler line=412 msg="iprope_in_check() check failed on policy 0, drop"
The problem is that I cannot select the new "DNAT & Virtual IP" in a policy, I just added temporarily a policy to allow everything from wan to lan with no luck
I tried it in many ways with no luck
Fortigate should have better documentation about its features
Do you know any document about how to forward a port from skratch?
Can you explain this to me?
I assisted a NSE4 course but we never seen this
Thanks in advance
Regards,
Damián
I just found the following in the Lab guide of the NSE4:
"You can't select VIPs previously created in a firewall policy as a destination address.
As soon as a VIP object is created, FortiGate automatically creates a rule in the kernel for DNAT to occur"
The guide asked me to enable a rule but the lab stopped being available when the curse ended
Image attached
Regards
No one knows Central NAT?
Regards
Damián
i think nobody cared when you said you were doing this all as part of a course and you have no access to a lab, and when the lab notes explicitly said you can't do what you tried to do.
This is not as part of a course, this is an issue in a fortigate that I configured for a customer, which is in production right now
I did the NSE4 course before and there I learn that there is something called "Central NAT" but they dont explain this well enought or I missed something.
I still need to forward some port but I could not find anything usefull in the course pdfs
Regards,
Damián
so then what is your problem exactly ? You need a policy permitting port81 traffic.
Take this out of theoretical. Show us the configuration commands you have in place and what you have tried??!
Hello,
I cannot forward port TCP 81, this is the problem
Temporarily added a rule to allow everything from WAN to LAN but nothing changed
The dst-nat is the following:
config firewall vip edit "Example" set uuid 71b50130-e166-51ea-3826-075742213cf8 set comment "Ejemplo de publicacion de puerto" set extip 179.60.208.66 set extintf "any" set portforward enable set color 18 set mappedip "10.1.1.234" set extport 81 set mappedport 81 next end
Regards,
Damian
Can we see the fw-policy that uses that VIP? Also do you have any other rules that are deny? You might need to set match vip enable.
https://kb.fortinet.com/kb/documentLink.do?externalID=FD33338
Also do not forget rule order-seq, but since your hitting implicit deny, I don't think that is the issue.
And lastly, if the rule has a DNAT-VIP, make sure you do not enable nat in the policy.
Ken Felix
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1712 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.