FortiGate - setup ZKTeco Biometrics to VM server

[gutta]

i have set the ZKTecho Biomertics ip:x.x.x.x to connected to VM server IP :x.x.x.x for montring attendence i have update the police for all ports but still the connection not coming . need to create the VIP for ZKTecho Biomertics ? becaue already i testing by this but not working please assist if you have idea how can we integrated ?

[ozkanaltas]

Hello @gutta ,

If your monitoring person connects from the internet to this server. Yes, you need to create a VIP. You can get more information about VIP in this document. Also if you can share your configuration with us, we can advise to you. 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati...

[hbac]

Hi @gutta,

Yes, you need VIP to allow incoming traffic. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-port-forwarding-using-FortiGate-...

Regards, 

[Renante_Era]

VIP are needed only if you want to access certain IP address and you want to forward specific or all traffic to a different IP address. For instance, if you want to access the device from outside through your public IP address -- since it's biometrics device then that's unlikely to be the case.
If the endpoints are in the same broadcast domain (Ex. biometrics 192.168.1.200/24, VM server: 192.168.1.201/24) then no need for firewall policy, if not, then create a firewall policy and make sure the IP address, subnet mask, and gateway are set correctly on that biometrics device.

[mokles]

Did you find any solution for this matter ?

[syao]

If it still does not work after creating a VIP and firewall policy, I suggest collecting the debug flow from the FortiGate while you reproduce the issue.

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/38044/using-the-debug-flow-t...