Firewall policies with DMZ interface

[Jaures]

Hello all,

I have a fortigate behind an edge router. The edge router is doing NAT for internal servers and internal users.

Internal servers are connected to the DMZ interface on the FOrtigate. Internal users are connected to the INSIDE interface.

the OUTSIDE interface connects to the edge router.

i have policies INSIDE -->DMZ allow all services, DMZ -->OUTSIDE allow all services on the fortigate.

I do not have any virtual IPs configured for the DMZ servers, since the edge router is the one performing the NAT function.

however, inside network cannot reach servers in the DMZ and DMZ servers cannot reach internet.

Any help on this please?

Thanks

Jaures.

[patrick_z]

Hi,

firewall in "NAT Mode" or "transparent"?

You are routing IPs so DMZ and internal are different networks?

The edge router knows about the IPs that are coming from Internal + DMZ?

Cheers, patrick

[Jaures]

Hello Patrick,

Firewall is in NAT mode.

Yes, DMZ and internal are on different networks.

The edge router knows about internal and DMZ subnet IPs.

[patrick_z]

Hi Jaures,

and the firewall is default gateway for all the clients/servers behind the firewall?

And static routing is set as well?

Edge router needs a next hop routing for the DMZ and internal range with fortigate

is next hop device. To say it in general: the edge router needs to know that the DMZ/internal

network can be found behind the fortigate.

No NAT is needed on the policies if IP routing only thing you want to have.

So

server --- DMZ --- fortigate --- outside ---Edgerouter

client -- internal----/

Check static routes

Check policies - you will need internal -> DMZ

internal -> outside

DMZ -> outside

If DMZ should be able to reach internal as well for some services you need a policy there as well.

If this is not working then try to view traffic with diag sniffer packet <interface> 'none' 4

there you should see incoming and outgoing interface etc. etc.

google a little bit for more possibilities to use diag stuff

Cheers, Patrick

[Jaures]

Hello Patrick,

Thank you very much for your contributions.

Finally there was no issue with my Fortigate configs.

I went through the configs step by step, making sure of all the points you mentioned and voila! :)

All traffic with policies enabled were passing, INSIDE --> DMZ , DMZ --> OUTSIDE , and so on...

One thing i need to ask though is this:

When you remove ports from the hardware switch (LAN) on the fortigate (200D in my case), is there any zone configuration to be done before you can use them?

or you can straight away treat them as physical interfaces and have let's say port1 as your LAN and port 2 as your DMZ and have policies like: port1 ---> port2  

                                       port1 --> wan1           and so on...

                                       port2 ----> wan1

Regards,

Jaures

[ashukla_FTNT]

Jaures wrote:

however, inside network cannot reach servers in the DMZ and DMZ servers cannot reach internet.

Based on the symptoms it seems the gateway on DMZ server is wrong.