FortiGate 40F WAN config issue

[Chrissee]

Hi together,

I have the following problem. I have a FortiGate 40F and a LAN configured (192.168.1.0/24) and I have connected the WAN port to another network (10.148.238.0/25).

I have created 2 firewall rules, only for testing. Later I will only open needed ports.

Name	Source	Destination	Schedule	Service	Action	NAT
LAN -> WAN	all	all	always	ALL	ACCEPT	Enabled
WAN -> LAN	all	all	always	ALL	ACCEPT	Enabled

I can reach a computer from the LAN via RDP in the WAN but not vice versa. With port forwarding I only have the option of specifying the IP of the FortiGate WAN port. How do I manage to specify a LAN address? Have I overlooked something?

Thank you very much for your tips and help.

Regards,

Christian

[Toshi_Esumi]

Why do you think you need to enable NAT for both policies? It's just private subnets on both ends without going out to the internet. They can reach each others without NAT.

Toshi

[Chrissee]

Hi Toshi,

Thanks for your answer. In the WAN network I have a proxy with internet access.

Regards,

Christian

[Toshi_Esumi]

Then you need to separate policies between from/to the /25 and internet. Then set the NAT only for toward the internet. The /25 access doesn't need NAT.

Toshi

[dingjerry_FTNT]

@Chrissee ,

1) The NAT requirement for Internet traffic is from LAN to WAN, right?  If so,:

1.1) Will the Proxy do the NAT as well? If yes, no need to turn on NAT for policy allowing LAN to WAN.

1.2) The issue is for RDP from WAN network 10.148.238.0/25 to LAN network 192.168.1.0/24.  No NAT is needed.

2) So after disable the NAT, we may run sniffer packets capture and debug flow commands for in-depth TS.

diag sniffer packet any 'host x.x.x.x and host y.y.y.y and port 3389' 4    //  x.x.x.x and y.y.y.y are the IPs of the client PC IP and RDP server IP

diag debug flow show iprope enable

diag debug flow filter addr x.x.x.x  // The IP of the RDP server

diag debug flow filter port 3389

diag debug flow trace start 1000

diag debug enable

Then reproduce the issue to collect the debug outputs.