FTP behind VIP, choosing wrong outbound interface

[Klimaks]

Hello, I have a problem setting up an FTP-server behind a VIP. We have 2 wan lines: I' ve added a VIP to one of them with the internal IP of the FTP I' ve created a security policy wan > vip to allow ftp and ICMP Pinging the vip works fine, but when I try to start an FTP-session I notice something strange in my debug log:

 id=36870 trace_id=1943 msg=" allocate a new session-046e00b0" 
 id=36870 trace_id=1943 msg=" find SNAT: IP-192.168.200.1(from IPPOOL), port-21" 
 id=36870 trace_id=1943 msg=" VIP-192.168.200.1:21, outdev-internal1" 
 id=36870 trace_id=1943 msg=" DNAT XXX.143.64.147:21->192.168.200.1:21" 
 id=36870 trace_id=1943 msg=" find a route: gw-192.168.200.1 via dmz" 
 id=36870 trace_id=1943 msg=" Allowed by Policy-27:" 
 id=36870 trace_id=1943 msg=" run helper-ftp(dir=original)" 
 id=36870 trace_id=1944 msg=" vd-root received a packet(proto=6, 192.168.200.1:21->XXX.50.75.228:22095) from dmz." 
 id=36870 trace_id=1944 msg=" Find an existing session, id-046e00b0, reply direction" 
 id=36870 trace_id=1944 msg=" find a route: gw-YY.199.98.65 via internal2" 
 id=36870 trace_id=1944 msg=" SNAT 192.168.200.1->XX.143.64.147:21" 
 id=36870 trace_id=1944 msg=" run helper-ftp(dir=reply)" 
 

(our wan lines are connected on internal1/internal2) Traffic comes in at internal1, so far so good, but it seems it tries to send the outgoing traffic to our other wan interface (internal2). Why ?

[Carl_Wallmark]

Hi, and welcome to the forum. Im guessing your default gateway points to Internal 2? (or have a higher priority than internal 1) Can you show the routing monitor ?

[Klimaks]

Hello, Default gateway on dmz-server = ip-address of dmz-interface on fortigate And if I open http://whatismyipaddress.com/ from the dmz-server it shows me the wan-ip of internal1

 Static	 	0.0.0.0/0	10	0	XX.143.64.145	internal1	 
 Static	 	0.0.0.0/0	10	0	YY.199.98.65	internal2	 
 Static	 	10.10.10.0/24	3	0	10.10.12.6	internal6	 
 Connected	 	10.10.12.0/24	0	0	0.0.0.0	internal6	 
 Static	 	10.32.100.0/24	1	0	10.201.128.90	wan1	 
 Static	 	10.201.32.0/24	3	0	0.0.0.0	Wel-Pol Ph1	 
 Static	 	10.201.32.0/24	3	0	0.0.0.0	Wel-PolSDSLPh1	 
 Connected	 	10.201.128.0/22	0	0	0.0.0.0	wan1	 
 Connected	 	XX.143.64.144/29	0	0	0.0.0.0	internal1	 
 Connected	 	YY.199.98.64/29	0	0	0.0.0.0	internal2	 
 Static	 	172.20.10.0/24	3	0	0.0.0.0	ssl.root	 
 Connected	 	192.168.200.0/24	0	0	0.0.0.0	dmz	
 

[emnoc]

Can you do a big favor and send a copy of the fwpolicy #27 ? If you loook at the NAT entries it looks strange.

[rwpatterson]

Also it could be Fortigate load balancing where even IPs go out wan2 and odd go out wan1. A simple policy route for that server/port could do the trick. Even/Odd IPs refer to the last octet.

[emnoc]

Or the ISP have reverse path forwarding and don' t allow the source address of the VIP out thru that carrier. To test the VIP as-is, dropped the other ISP provider interface/route and retest or reduce the inferior ISP default-route via distance or priority