God day.
Need help in configuring my fortigate with 2 WAN ports One network through port wan1 have office internet and mail server with VIPs second network through port WAN2 have wifi guest network The problem is that from WAN2 it is impossible go to WAN1 mail server OWA page.
WAN`s taken from one internet provider with different IP and have different distance, internet to WAN2 set up through Routing policy.
Can anyone help?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi ,
I have similar design . Explain with Eg:
( Lan) interface Port 1 : 172.16.1.1/24
( Guest_Network_Subnet )Interface: Port2 : 10.10.10.1/24
WAN1 :100.100.100.1/24
OWA Server Ip :172.16.1.10/24 GW :172.16.1.1
OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)
Now Policy :
Create a Destination NAT Policy for OWA from internet :
Incoming interface : WAN1
Sourse Sunet :All
Destination Interface :Port1(LAN)
Destination Subnet :OWA-VIP
Set Service :All
Set action :Allow
NAT "Disbaled"
Create a PolicyGuest to access OWA from Guest Network:
Incoming interface : Port2
Sourse Subnet :Guest-Network_Subnet
Destination Interface :Port1(LAN)
Destination Subnet :OWA-VIP
Set Service :All
Set action :Allow
Nat :Disabled
Hope this is clear.You just need U turn policy from guest network .
Regds
Ashik
ashik wrote:HiHi ,
I have similar design . Explain with Eg:
( Lan) interface Port 1 : 172.16.1.1/24
( Guest_Network_Subnet )Interface: Port2 : 10.10.10.1/24
WAN1 :100.100.100.1/24
OWA Server Ip :172.16.1.10/24 GW :172.16.1.1
OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)
Now Policy :
Create a Destination NAT Policy for OWA from internet :
Incoming interface : WAN1
Sourse Sunet :All
Destination Interface :Port1(LAN)
Destination Subnet :OWA-VIP
Set Service :All
Set action :Allow
NAT "Disbaled"
Create a PolicyGuest to access OWA from Guest Network:
Incoming interface : Port2
Sourse Subnet :Guest-Network_Subnet
Destination Interface :Port1(LAN)
Destination Subnet :OWA-VIP
Set Service :All
Set action :Allow
Nat :Disabled
Hope this is clear.You just need U turn policy from guest network .
Regds
Ashik
I have a difference from your configuration, guest lan using physical WAN2 with another subnet.
According to your example, something like the following :
( Lan) interface Port 1 : 172.16.1.1/24
( Guest_Lan )Interface: Port2 : 10.10.10.1/24
WAN1 :100.100.100.1/29
WAN2 :100.200.200.1/29
OWA Server Ip :172.16.1.10/24 GW :172.16.1.1
OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)
Static routes:
WAN1 :100.100.100.1/29 distance 10
WAN2 :100.200.200.1/29 distance 20
Routing policy
(guest lan) routed from Port2: 10.10.10.1/24 to WAN2 : 100.200.200.1/29
Ipv4 Policy :
Create a Destination NAT Policy for OWA from internet :
Incoming interface : WAN1
Sourse Sunet :All
Destination Interface :Port1(LAN)
Destination Subnet :OWA-VIP
Set Service :All
Set action :Allow
NAT "Disbaled"
The decision that was proposed a really worked with only WAN1 for both subnets, but in my configuration I need something else.
Hi ,
You don't have to worry about WAN2 , coz traffic is internally routing between guest and lan network .Yes , may be you have policy route 0.0.0.0/0 from guest network to reach WAN2 , this may affect your traffic to reach to LAN .
Just create a another policy route on top of 0,0.0.0/0 to LAN or Sever network and select stop policy route option .
Finally u need below policy only
Create a PolicyGuest to access OWA from Guest Network: Incoming interface : Port2 Sourse Subnet :Guest-Network_Subnet Destination Interface :Port1(LAN) Destination Subnet :OWA-VIP Set Service :All Set action :Allow Nat :Disabled
Hope you understood the configuration .
Regds,
Ashik
ashik wrote:Hi ,
You don't have to worry about WAN2 , coz traffic is internally routing between guest and lan network .Yes , may be you have policy route 0.0.0.0/0 from guest network to reach WAN2 , this may affect your traffic to reach to LAN .
Just create a another policy route on top of 0,0.0.0/0 to LAN or Sever network and select stop policy route option .
Finally u need below policy only
Create a PolicyGuest to access OWA from Guest Network: Incoming interface : Port2 Sourse Subnet :Guest-Network_Subnet Destination Interface :Port1(LAN) Destination Subnet :OWA-VIP Set Service :All Set action :Allow Nat :Disabled
Hope you understood the configuration .
Regds,
Ashik
Bingo!!!!
Ashik - thanks for the help! everything is works
The main problem was in understanding that traffic in my case would go locally
DanieZ wrote:ashik wrote:Hi( Lan) interface Port 1 : 172.16.1.1/24
( Guest_Network_Subnet )Interface: Port2 : 10.10.10.1/24
WAN1 :100.100.100.1/24
OWA Server Ip :172.16.1.10/24 GW :172.16.1.1
OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)
Now Policy :
Create a Destination NAT Policy for OWA from internet :
Incoming interface : WAN1
Sourse Sunet :All
Destination Interface :Port1(LAN)
Destination Subnet :OWA-VIP
Set Service :All
Set action :Allow
NAT "Disbaled"
Create a PolicyGuest to access OWA from Guest Network:
Incoming interface : Port2
Sourse Subnet :Guest-Network_Subnet
Destination Interface :Port1(LAN)
Destination Subnet :OWA-VIP
Set Service :All
Set action :Allow
Nat :Disabled
Hope this is clear.You just need U turn policy from guest network .
Regds
Ashik
I have a difference from your configuration, guest lan using physical WAN2 with another subnet.
According to your example, something like the following :
( Lan) interface Port 1 : 172.16.1.1/24
( Guest_Lan )Interface: Port2 : 10.10.10.1/24
WAN1 :100.100.100.1/29
WAN2 :100.200.200.1/29
OWA Server Ip :172.16.1.10/24 GW :172.16.1.1
OWA-VIP : External IP :100.100.100.10 --Internal:172.16.1.10 (OWA Server Real IP)
Static routes:
WAN1 :100.100.100.1/29 distance 10
WAN2 :100.200.200.1/29 distance 20
Routing policy
(guest lan) routed from Port2: 10.10.10.1/24 to WAN2 : 100.200.200.1/29
Ipv4 Policy :
Create a Destination NAT Policy for OWA from internet :
Incoming interface : WAN1
Sourse Sunet :All
Destination Interface :Port1(LAN)
Destination Subnet :OWA-VIP
Set Service :All
Set action :Allow
NAT "Disbaled"
We often called this one as hair pinning. Kindly try this approach.
Static routes:
WAN1 :100.100.100.1/29 distance 10
WAN2 :100.200.200.1/29 distance 10
Policy Route (often called as PBR)
Policy 1
input-device : "port2" src : "10.10.1.0/255.255.255.0" dst : "100.100.100.10/255.255.255.255" "172.16.1.10/255.255.255.255"
action : deny
status : enable
Policy 2
input-device : "port2"
src : "10.10.1.0/255.255.255.0" action : permit protocol : 0 gateway : 0.0.0.0 output-device : WAN2
DNAT Rule
Incoming interface : WAN1
Source Subnet :All
Destination Interface :Port1(LAN)
Destination Subnet :OWA-VIP
Set Service :All
Set action :Allow
NAT "Disbaled"
Fortigate Newbie
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1645 | |
1070 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.