Do virtual servers (aka load balancing) work in DMZ's?

[ispcolohost]

I have a situation where I need to use the virtual server / load balancing feature of 5.6.  My wan1 interface only has a /29 assigned by the upstream, and I don't have free address space there.  I have a /24 routed to my wan1 address for use in a DMZ which is a separate vlan off the fortigate.

Since I don't have free space on the external /29 wan1 interface, I'm trying to deploy a load balancing virtual server on the DMZ vlan where I do have extra address space.  So I add a virtual server just like I normally would, set interface to ANY since I can't get them to work at all when picking a specific interface, define the VIP and the real servers.  Load balance monitor shows my real servers as up.  I add two firewall rules.  One permits any on wan1 to VIP on dmz interface, no nat.  The second permits any on dmz to the virtual host on the internal vlan interface.  This didn't work.  I tried several combinations of source and destination interfaces for both rules and can't find one that works.

The virtual servers I have defined on wan1 and pointing to dmz physical systems do work.  The virtual servers I have defined on wan1 that point to internal systems also work.  Virtual servers defined that are defined on dmz, which are dependent on a rule letting the traffic from wan1 to dmz, and a second rule permitting dmz/vip to internal net, do not work.  This is making me wonder if there's some kind of issue where virtual servers are not compatible with the firewall also routing traffic in to the network where the virtual server exists?

Perhaps easier to understand example:

upstream - 192.168.0.1/29

wan1 - 192.168.0.2/29 

wan1 virtual servers - 192.168.0.3-192.168.0.6

upstream routes 192.0.2.0/24 to wan1 IP

dmz1 - 192.0.2.1/24

dmz1 host space - 192.0.2.2-192.0.2.254

192.168.0.3 wan1 VIP pointing to dmz1 resource or internal resource, both work fine.  Only one firewall rule required; permit any on wan1 to https on VIP with dmz1 or internal as outbound interface depending on location of resource.

192.0.2.3 dmz1 VIP pointing to internal resource, does not work.  Two firewall rules required.  Permit any on wan1 to dmz1 vip, any service.  Permit any to https to internal, target is VIP; tried either source interface dmz1, wan1, etc. none work.

[MikePruett]

I have clients that run load balanced servers on DMZ's, random VLANs etc. The interface shouldn't matter. as long as you tie it to the policy, server setup, etc the way you should (pretty much the same way in all spots)