Fortigate 40F VIP not working for same network

[Kennylin]

Hi all, 

We have a Fortigate 40F (7.6.x) with the following configured:

1) WAN x.y.z.138 public address (connected to Internet)

2) LAN 192.168.1.254

3) VIP : x.y.z.136 --> 192.168.1.6 

4) Two firewall rules: one allowed all sources to access the VIP , the other allowed x.y.z.0/24 to access the VIP

The VIP forwarding is working fine except for client with x.y.z.133 (same network with Fortigate's WAN), from which all requests are just time-out and no response.

Any idea is appreciated !

Kenny Lin

[esalija]

Hi @Kennylin 

To troubleshoot the issue where a client with the IP address x.y.z.133 is unable to access the VIP, follow these steps:

1. Ensure that the firewall policy allowing access to the VIP is correctly configured and prioritised. The policy should allow traffic from the source IP x.y.z.133 to the VIP.
2. Verify that the VIP is correctly configured to map the external IP x.y.z.136 to the internal IP 192.168.1.6. Ensure that the port forwarding settings are correct if applicable.

3. Confirm that there is a valid route for the traffic from x.y.z.133 to reach the FortiGate and that the return path is correctly configured.
4. Check for Overlapping Subnets: Ensure there are no overlapping subnets or IP conflicts that might be causing routing issues.

Debugging:

Use the following debug commands to gather more information:
diagnose debug reset
diagnose debug flow filter clear
diagnose debug flow filter addr x.y.z.133
diagnose debug flow trace start 255
diagnose debug enable

Initiate traffic from x.y.z.133 and observe the debug output for any anomalies or errors.

Stop Debugging:

Once you have gathered enough information, stop the debug process:

diagnose debug disable
diagnose debug reset

- Review the FortiGate logs for any denied traffic or errors related to the client IP x.y.z.133.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restrict-the-traffic-to-VIP-for-specific-g...
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-VIP-access-where-specific...

Best regards,
Erlin

[syordanov]

Hello Kenny ,

I hope you are doing well. It will be useful if you run the following debug when the user is testing the access from x.y.z.133 to x.y.z.136 , please use the following debug :

diagnose debug reset

diagnose debug disable

diagnose debug flow trace stop

diagnose debug flow filter clear

diagnose debug flow show iprope enable

diagnose  debug  flow show function-name enable

diagnose debug flow filter saddr x.y.z.133  <--- source IP 

diagnose  debug  console timestamp enable

diagnose debug flow trace start 1000

diagnose debug enable

---

Once the debug flow is started, please test the access from x.y.z.133 (you can replace the source and VIP external IP addresses with x.y.z.133 and x.y.z.136 ).

To stop the debug, please run :

diagnose debug reset

diagnose debug disable

Thank you.

Fortinet

[Kennylin]

Thanks Erlin and syordanov for quick reply.

I tried to fetch the debug messages as you guided, and check it out carefully.

But not able to find anything wrong. 

Could you guys help ? https://drive.google.com/file/d/1CPxLI_bB9O5SVYiyikRmrR2oc-tj6g6f/view?usp=drive_link

Thanks again,

Kenny