FortiGate self originated traffics source IP changing

[lubionline]

Hello All,

I have a fortigate 50E firewall. 

The WAN interface IP is private IP 172.24.2.101/30 with gateway 172.24.2.102/30 and ISP have given a Pool of public IP as LAN.

I can set the public IP pool given by ISP as Virtual IP and use that in policy for internal users NAT to connect to internet and which works fine.

My issue is that the fortigate self originated traffic is still using WAN ip to connect to internet and it gets failed as it is a private IP.

Due to this device is unable to register, unable to activate webfilter and so on.

Is there any way to change the fortigate self originated traffic source IP when it used to communicate to internet?

[Sunil_Panchal_NSE7]

dear friend ,

      i have the same issue . just recently we removed ISP cisco router due to fault in hardware of cisco router with fortigate  100e .

on wan side ISP gave us private ips and a pool of public ip. i am facing exactly same issue as you are facing .

please a quick response will be very helpfull

[EMES]

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-system-administration-54/Advanced/IP%...

You can set the source-ip to the inside interface which would fall under scrutiny of your IP Pool. the set source-ip must be an IP configured on the firewall.

config system fortiguard

set source-ip x.x.x.x

end

http://docs.fortinet.com/uploaded/files/2798/fortigate-cli-ref-54.pdf

If you look at the CLI reference and search for "set source-ip" you can find more options to set the source-ip.

Another option would be to create a Management VDOM, which means you would logically split the firewall in two thus allowing you have a true Out of Band Management Interface.

Hope that helps

[pushpendra11]

Hi Lubonline,

Please check the output of "get system source-ip status" with the help of this you can verify the actual ip that it is using to reach the fortiguard.

You can change the source-ip to the desired one if it is not appropriate in the output. Regards,Pushpendra11

[lubionline]

Hello,

Thanks for the inputs.

I have already tried to set the source ip but it is the same.

Logged a case with Fortigate support and they took remote session for two times for around 2hours each and still unable to fix it.

I will let everyone know if any positive progress.

[Lijo_Joseph]

Hi, I am facing the same issue with one of our FGT 101E device and I want to source traffic from a loopback . Even the traffic is not sourced from a mgmt interface as I have dedicated HA mgmt interface enabled. Wondering if anyone has found a solution already to this

[Alxndr3]

Hello,

Was that issue fixed, how? Thank you.