Fortigate 100D: configuring DMZ

[erotavlas]

Hi, I'm new of this forum and of fortinet device. I have to install a Web server on GNU/linux zentyal 6 in a network managed by a fortinet fortigate 100D v6.0.5 build0268 firewall with DNS and active directory provided by Windows server 2016 machines. I followed this guide https://cookbook.fortinet...eb-server-with-dmz-54/ about how to setup a DMZ for the Web server. The only thing that is different in my configuration compared to the guide is that I'm using a DMZ port on the firewall instead of port3 as interface. So I have LAN on 10.0.0.0/16 network, DMZ on 10.10.10.0/24 networks (Web server with fixed internal IP 10.10.10.2/24, gateway 10.10.10.1 and DMZ with fixed external IP) and fortinet on 10.10.10.1 (DNS and active directory on LAN). At the moment, I can execute ping from firewall toward Web server and the opposite. While I'm not able to reach the Web server both from internal LAN and external network. Moreover, I cannot reach Internet from my Web server (I have to investigate if it could be a DNS problem). What am I missing? Thank you

[hubertzw]

Do you have firewall policies for LAN-DMZ? You need this for DNS for example. Do you have ICMP in the policy INTERNET-DMZ or only HTTP, HTTPS? Don't leave ICMP in the production. Limit the number of protocols to minimum.

[julienlux]

On your post you mentionned that Webserver ip is 10.10.10.2 and Gateway 10.10.10.2. Do I understand correctly?

What is the IP of DMZ port of your Fortigate? This ip should be the default gateway of your server.

[erotavlas]

julien.lacava wrote:

On your post you mentionned that Webserver ip is 10.10.10.2 and Gateway 10.10.10.2. Do I understand correctly?

 

Thank you, I corrected my post. The gateway of the Web server is 10.10.10.1.

julien.lacava wrote:

What is the IP of DMZ port of your Fortigate? This ip should be the default gateway of your server.

How can I check it? I assigned a subnet 10.10.10.0/24 to the DMZ interface and so I think it should be 10.10.10.1.

[erotavlas]

I followed exactly the guide reported on the link. So you are right in order to obtain a DNS via DHCP I need a link between DMZ and my LAN where is the DHCP server. However, I prefer to setup a manual DNS on the Web server in order to maintain the DMZ and LAN isolated.

At the moment I enabled ICMP for testing functionality.

What is missing on fortigate side? Do you think that it is ok and I have to change something into the Web server?

Thank you

[julienlux]

Can you post a copy of your configuration and also tell me what is working and what is not?

[erotavlas]

julien.lacava wrote:

Can you post a copy of your configuration and also tell me what is working and what is not?

Hi,

it is working all except the DMZ. I have to install a Web server that works if I leave out of firewall, while it does not work inside DMZ created by fortinet as described before.

Do you need the configuration file of the fortinet? Can I post it here?

[hubertzw]

erotavlas wrote:

The gateway of the Web server is 10.10.10.1.

How can I check it? I assigned a subnet 10.10.10.0/24 to the DMZ interface and so I think it should be 10.10.10.1.

Can you confirm you set 10.10.10.1/24 IP on the DMZ interface? -> 'show system interface'

Do you have policy for traffic between LAN<->DMZ?

When you post your config remove public IP.