Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ABE_63
New Contributor III

Fortigate behind existing firewall not receiving VPN connection due to private WAN IP

I am running some tests trying to connect a client workstation to another client that sits behind my Fortigate. The trouble is, the Fortigate connects out to the internet via an existing firewall (edge). Therefore the Fortigate is receiving a Private IP from the edge firewall on it's WAN interface. I have proven that I can establish a VPN connection to WANs private IP when connecting the client to the LAN of the edge firewall but now I want to prove that I can create a VPN connection from anywhere in the world. When I enter the public IP address of the edge firewall into Forticlient, I get an error saying VPN down. What must I do to be able to connect from a client in a different location over the internet, through the edge router, into the fortigate and to the "accessible LAN"?

1 Solution
ABE_63
New Contributor III

Many thanks for your help. I found @kcheng post helpful in narrowing down where i needed to troubleshoot. Having already tried to configure DDNS and finding that it didn't work, my suspicions led me to believe that this wouldn't work using a private IP alone. I then followed @ozkanaltas guidance, created a forward rule: 

Source: <FortiClient machine public IP>, port: 443,

Forward IP: <Local LAN IP assigned to Fortigate WAN interface>, Forward port: 443, Protocol: TCP.

 

After applying this rule and running the sniffer on the fortigate "diag sniffer packet any "host <client public IP> and port 443" 10di 0 l" the connection still didn't work. It was only when i followed @jiahoong112 guidance on setting DDNS again that a connection was established and I could see traffic in the FortiCLI sniffer.

 

As a side note: When I originally tried this, I had configured the port as 10443 in both the FortiClient, the Forwarding rule on the edge router and in the SSL VPN Settings. For some reason this did not work. It's possible that I may have missed something. But at least I have it working and can circle back to that another time. Thanks again for all the help!

View solution in original post

9 REPLIES 9
ozkanaltas
Contributor III

Hello @ABE_63 ,

 

If you configure Destination NAT to Fortigate private IP addresses on your edge firewall.  This should be work. After doing this configuration, you can connect your FortiGate for SSL VPN.

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE4-5-6-7 OT Sec - ENT FW
jiahoong112
Staff
Staff

For this, you can use DDNS for sslvpn purposes. Kindly refer here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-DDNS-for-SSL-VPN/ta-p/194137 

**If you come across a resolution, kindly show your appreciation by liking and accepting it, ensuring its accessibility for others**
Toshi_Esumi
Esteemed Contributor III

I wouldn't think the DDNS works when the FGT's wan interface gets a private IP from the GW/NAT device in upstream. I believe DDNS works only when the FGT's wan interface gets a public IP that is reachable from the internet, but it's dymamic and keeps changing time to time.

 

Toshi

kcheng
Staff
Staff

Hi @ABE_63 

 

First thing that I would advise you to check is the reachability of the FortiGate SSLVPN service from the external connection. Since the FortiGate is receiving a private IP from the upstream device, NAT should be performed on your upstream device. You can attempt to troubleshoot the respective via the following steps:

1. Obtain the public IP of you client where VPN Client is installed. (https://ipchicken.com)

2. Run sniffer on the FortiGate either with CLI console or SSH session:

diag sniffer packet any "host <client public IP> and port <SSLVPN port>" 4 0 l

** Replace client public IP with the result you obtained in step 1, and the port you configured for SSLVPN access

3. If you do not observe output from the above step, the edge device would be where you need to further troubleshoot.

4. If you observe output from the above step, then you will have to enable sslvpn debug to check further on the actual root cause:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-Troubleshooting/ta-p/189542

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Possible-reasons-for-FortiClient-SSL...

 

Cheers,
Kayzie Cheng

If you have found a solution, please like and accept it to make it easily accessible for others.
hbac
Staff
Staff

Hi @ABE_63,

 

Yes, you can use DDNS as mentioned by jiahoong112. It will work even though your FortiGate WAN interface doesn't have a public IP address. Users can use DDNS domain name to connect to the VPN. 

 

You also need to make sure that the edge firewall forwards incoming traffic from the Internet to the FortiGate. 

 

Are you using SSL or IPsec VPN? What is the error message when connecting?

 

Regards, 

Toshi_Esumi
Esteemed Contributor III

Ok, So you're saying the FortiGuard side, not the FGT side, keeps learning the public IP (NAT outside IP) the FGT is coming from and set that IP with the DNS name. I'll test that to confirm.

Thanks,

 

Toshi

hbac

@Toshi_Esumi,

 

Yes, there is an option to use public IP when enabling DDNS and the DNS record will keep changing dynamically based on that public IP. 

 

Regards, 

 

Regards, 

Toshi_Esumi
Esteemed Contributor III

It's confirmed that DDNS works behind a NAT device. The "set use-public-ip enable" is required when the wan interface is behind a nat device in upstream.

config system ddns
  edit 1
    set ddns-server FortiGuardDDNS
    set ddns-domain "xxx.fortiddns.com"
    set use-public-ip enable
    set monitor-interface "wan1"
  next
end

Toshi

ABE_63
New Contributor III

Many thanks for your help. I found @kcheng post helpful in narrowing down where i needed to troubleshoot. Having already tried to configure DDNS and finding that it didn't work, my suspicions led me to believe that this wouldn't work using a private IP alone. I then followed @ozkanaltas guidance, created a forward rule: 

Source: <FortiClient machine public IP>, port: 443,

Forward IP: <Local LAN IP assigned to Fortigate WAN interface>, Forward port: 443, Protocol: TCP.

 

After applying this rule and running the sniffer on the fortigate "diag sniffer packet any "host <client public IP> and port 443" 10di 0 l" the connection still didn't work. It was only when i followed @jiahoong112 guidance on setting DDNS again that a connection was established and I could see traffic in the FortiCLI sniffer.

 

As a side note: When I originally tried this, I had configured the port as 10443 in both the FortiClient, the Forwarding rule on the edge router and in the SSL VPN Settings. For some reason this did not work. It's possible that I may have missed something. But at least I have it working and can circle back to that another time. Thanks again for all the help!

Labels
Top Kudoed Authors