Firewall Policy / DNS Integration

[zeeshanakkbar]

Hi,

my query is mix and match and hopes that someone will definitely help me to get me out of this with your expertise. i am very thankful to all of you.

1. I have Windows DNS of Network "192.0.0.x" with the local domain "example.com" and my website is also with the same name "example.com" that is hosted on remote cloud/VPS.

2. I have VLAN infrastructure and my Wireless LAN Network is '172.16.2.0".

3. My Local DNS has the "A" Record of my public website domain. and the public website is perfectly accessible from the Same Network (192.0.0.x).

4. When I try to access the example.com (Website) from 172.16.2.0 Network. it is not accessible from 172.16.2.x network. while the when i ping the www.example.com it is going reachable. and traceroute is also be going ok.

5. Question is : how to make changes in Fortigate firewall that "www.example.com"  is being accessible from the local network of other vlan subnet.  

[seshuganesh]

 I have Windows DNS of Network "192.0.0.x" with the local domain "example.com" and my website is also with the same name "example.com" that is hosted on remote cloud/VPS.

--> May i know what is the ip address of the example.com and how it is connected to the existiing network
 When I try to access the example.com (Website) from 172.16.2.0 Network. it is not accessible from 172.16.2.x network. while the when i ping the www.example.com it is going reachable. and traceroute is also be going ok.

If the ping is getting reachable i believe you should be able to webserver for http access as well, when you are pinging are you getting response from expected ip address?
Did you define any rules in the webserver to access site only from specifci ip address?

[zeeshanakkbar]

Sure. IP Address of www.example.com  is 204.93.161.x. yes when i ping example.com (Which is local domain) it responsed perfectly from 192.0.0.x and when i ping www.example.com it also responed from 204.93.161.x. 

2ndly i haved checked the http and https allow in policy but the result was the same. even i have allow all services and any destination but i was still unable to access from the other vlan local subnet (172.16.2.x). 

[seshuganesh]

Sure. IP Address of www.example.com  is 204.93.161.x. yes when i ping example.com (Which is local domain) it responsed perfectly from 192.0.0.x and when i ping www.example.com it also responed from 204.93.161.x. 

---could you please explain this line again, you mean to say dns lookup domain is resolving to two different ipa ddress?

can you do nslookup from the problematic subnet and see what is the ip address it is resolving to?

[AEK]

Edit the firewall policy that is allowing ping and traceroute toward your destination (www.example.com), and add http & https to the allowed services.

[zeeshanakkbar]

yes, I had also done this, and even allowing any service in the policy is not affect the requirement. and the site is still inaccessible from the local subnet of other VLAN. 

[AEK]

Please ty this steps:

- Enable all logs in that policy

- try some ping tests and http(s) access tests from your client

- right click on the policy and click on "show matching logs" sub-menu

- take a screenshot share with us (must show source, destination, service, result)

[sw2090]

when you can succesfully ping the example.com from out of the other net that means that dns works correctly and routing/Policy works correctly.

It also means that the network config on the example.com webserver has to be correct because with no or wrong default gw you would get no ping reply (unless there is a static or connected route there)

If you say even with any service allowed in the policy http(s) to the example.com does not work that looks more like some limit of the webserver running there like local os firewall on that webserver or something like that. 

[tthrilok]

When I try to access the example.com (Website) from 172.16.2.0 Network. it is not accessible from 172.16.2.x network. 

When you say you are not able to access, could you confirm what is the exact error are you seeing. You may also check in the policy where this traffic is matching, if the web-filter is called. If it is so, could you please make sure the domain/category is not blocked.