Firewall VIP no port forwarding without specifying port

[peter_wickenberg]

Hi

We're having some difficulties with a VIP-rule for allowing guest-network to access printer in the production network. Problem is with that when the VIP is configured to allow all ports instead of specific port forwarding, the printer is unable to reach outside of the local network, not reaching the smtp server for scanning to email.

This is the rule to allow access to the printer from guest network

edit 10 set uuid 29dc4ec2-8edb-51e6-8e1b-322f58384d3b set srcintf "guest-zone" set dstintf "client-zone" set srcaddr "n_suf-osd1.guest1_10.100.0.0/24" set dstaddr "vip_samsung9310_10.100.0.250-192.168.50.205_9100-tcp" set action accept set schedule "always" set service "ALL"

And this is the rule to allow communication to the smtp-server outside the network

edit 18 set uuid 8bd84e10-79e0-51e6-df3f-90b207201633 set srcintf "client-zone" set dstintf "wan1" set srcaddr "n_suf-osd1.production_192.168.50.0/24" set dstaddr "fqdn_smtp.systemetit.se" set action accept set schedule "always" set service "SMTP" "SMTPS" set nat enable

And this is the VIP for the printer

edit "vip_samsung9310_10.100.0.250-192.168.50.205_9100-tcp" set uuid a00dc676-8eda-51e6-ab46-b2e07fa30d03 set extip 10.100.0.250 set extintf "any" set mappedip "192.168.50.205"

This is the output of the debug flow that happens between the printer and the smtp-server (185.11.99.207) with VIP set to allow all instead of specific forwarding

suf-osd1fw01 # diag sniff packet any 'host 185.11.99.207' 4 interfaces=[any] filters=[host 185.11.99.207] 2.222191 wan1 in 185.11.99.207.25 -> 217.115.46.34.63704: psh 3269103656 ack 2347298412 id=20085 trace_id=1 func=print_pkt_detail line=4471 msg="vd-root received a packet(proto=6, 192.168.50.205:55205->185.11.99.207:25) from vid101_Office. flag , seq 332058280, ack 0, win 5840" id=20085 trace_id=1 func=init_ip_session_common line=4624 msg="allocate a new session-00674c9a" id=20085 trace_id=1 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-217.115.46.33 via wan1" id=20085 trace_id=1 func=fw_forward_handler line=686 msg="Allowed by Policy-18: SNAT" id=20085 trace_id=1 func=__ip_session_run_tuple line=2593 msg="SNAT 192.168.50.205->10.100.0.250:55205" 5.755387 vid101_Office in 192.168.50.205.55205 -> 185.11.99.207.25: syn 332058280 5.755979 wan1 out 10.100.0.250.55205 -> 185.11.99.207.25: syn 332058280

id=20085 trace_id=2 func=print_pkt_detail line=4471 msg="vd-root received a packet(proto=6, 192.168.50.205:55205->185.11.99.207:25) from vid101_Office. flag , seq 332058280, ack 0, win 5840" id=20085 trace_id=2 func=resolve_ip_tuple_fast line=4534 msg="Find an existing session, id-00674c9a, original direction" id=20085 trace_id=2 func=__ip_session_run_tuple line=2593 msg="SNAT 192.168.50.205->10.100.0.250:55205" 8.756605 vid101_Office in 192.168.50.205.55205 -> 185.11.99.207.25: syn 332058280 8.756934 wan1 out 10.100.0.250.55205 -> 185.11.99.207.25: syn 332058280 id=20085 trace_id=3 func=print_pkt_detail line=4471 msg="vd-root received a packet(proto=6, 192.168.50.205:55205->185.11.99.207:25) from vid101_Office. flag , seq 332058280, ack 0, win 5840" id=20085 trace_id=3 func=resolve_ip_tuple_fast line=4534 msg="Find an existing session, id-00674c9a, original direction" id=20085 trace_id=3 func=__ip_session_run_tuple line=2593 msg="SNAT 192.168.50.205->10.100.0.250:55205" 14.776985 vid101_Office in 192.168.50.205.55205 -> 185.11.99.207.25: syn 332058280 14.777322 wan1 out 10.100.0.250.55205 -> 185.11.99.207.25: syn 332058280 26.876067 vid101_Office in 192.168.50.205.57169 -> 185.11.99.207.587: syn 666977896 26.876656 wan1 out 10.100.0.250.57169 -> 185.11.99.207.587: syn 666977896

As you can see, for some reason the printer is trying to use the VIP IP address (10.100.0.250) instead of the real (192.168.50.205) to reach out to the SMTP server from the client-zone which of course is invalid.

If I instead set VIP up for forwarding 9100-tcp specifically instead this does not happen and the printer is able to reach the smtp server. So the question is why this is happening?