Fortigate VIP change from internal NAT to external

[MarkGerrard1981]

I'm currently in the process of migrating from our data centre to the cloud, at the moment we have two public facing DNS servers lets use 1.1.1.1 and 2.2.2.2 for there external IP addresses which are currently NAT'd to 10.1.1.1 and 10.1.1.2 this works fine.

What I need to do for testing is to keep the traffic flowing to 1.1.1.1 and 2.2.2.2 but instead of NAT'ing to the internal IP addresses I want to forward to two external DNS servers in the cloud say 10.10.10.10 and 20.20.20.20.

I'm sure in the past when I did this test I merely changed the two NATS from 1.1.1.1 -> 10.1.1.1 to 1.1.1.1 -> 10.10.10.10 and the other 2.2.2.2 -> 10.1.1.2 to 2.2.2.2 -> 20.20.20.20

This isn't working now for some reason, when I try and resolve a name I get a time out, but if I change the VIP back to the internal address it works again.

Does anyone know what I'm missing (eventually the firewall will be cut out from this and the DNS servers will be referenced by their external cloud IP's however for testing I want the ability to rock back and forth etc...?

Mark

[hbac · Accepted solution]

Hi @MarkGerrard1981,

It should work. Let say traffic is coming to wan interface of the FortiGate and because 10.10.10.10 and 20.20.20.20 are on the cloud, the FortiGate needs to forward the traffic back to the Internet via wan. Hence, you need to create a firewall policy to allow traffic from wan to wan with destination as VIP. 

Regards, 

[MarkGerrard1981]

Thank you so much!

That was exactly it, I had done that previously but for the 2nd DNS server VIP not the whole VIP group and when I was testing today I was changing the 1st DNS server VIP which wasn't specified in the external to external VIP policy, I added the whole VIP group in and now it let's me change the VIPS external to external and external to internal and they both work.

Thanks again,

Mark