Configuring VIP (DNAT) in Transparent mode

[Roman_Gelfand]

I took the following sample from tranparent mode technical guide. I used wan ip address for extip with service RDP. I am trying to establish rdp session from any wan address. I also set mappedip to the machine on internal lan with local ip. I am not able to establish rdp session with extip. Would anyone know what could be the problem? BTW.. It appears that not everything you could do from GUI and GUI is not able to show the entire configuration much like cisco. config firewall vip edit " vip1" set extip 192.168.183.48 set extintf " vlan160_p2" set mappedip 192.168.182.78 next end config firewall policy edit 4 set srcintf " vlan160_p2" set dstintf " vlan18_p3" set srcaddr " all" set dstaddr " vip1" set action accept set schedule " always" set service " ANY" next end

[Carl_Wallmark]

In transparent mode, you cant do VIP just like that, transparent dont route, however, there is a workaround, using the managament IP, then you can do a VIP. Never done it myself but i have read about it.

[Roman_Gelfand]

I am really lost now. Why is fortinet publishing documents claiming things that you can do but in reality you can' t.

[Carl_Wallmark]

Are you sure they didnt mention management ip ? in transparent mode, the FG acts like a switch, not a router. BIG differens ;) can you post a link to the documentation (also page) ?

[Roman_Gelfand]

The link is... http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FortigateTransparentModeTechnicalGuideFortiOS40v10pdf&sliceId=&docTypeID=DT_PRODUCTDOCUMENTATION_1_1&dialogID=4324921&stateId=0%200%204326901 If you could decipher this for me, I would greatly appreciate it. Thanks for your help.

[Carl_Wallmark]

If you look under the example picture, it says: -------------------------- Note : if the mappedip is on a different subnet than the management IP, the Fortigate must have a valid route to this destination --------------------------- and like i said before there is a way to route in transparent mode, but you have to use your " management ip" for the external ip.

[Roman_Gelfand]

k.. is there an issue with using management ip as an external ip?

[Carl_Wallmark]

yes and no, your management ip is your way to access the FG via http/https/telnet etc.. be sure to only allow the traffic you want for remote management