Fortigate to Fortigate NATing and Routing

[rockking06]

Please can some explain the below senario. These firewalls are on the same physical site, they share an interconnect VLAN / subnet that has nothing else on (better than a IPSEC VPN). I am in the process of segregating Dev from Prod, previously they were on the same firewall with a lot of over-lapping services. I want it to work using specific IPs as source on the Prod firewall and without NAT. But it wouldn't work and I don't know why. I have static routes in both directions, so I don't understand why this won't work without NATing. Any help is much appricated, Thanks!

Working setup:
Dev Fortigate:

  Interfaces:
    Dev subnet / VLAN
    Interconnect subnet / VLAN

  Static routes:

    IT Users subnet via Prod Fortigate on Interconnect network

    Prod servers subnet via Prod Fortigate on Interconnect network
  Policies (in order):

   1:

      From Int: Interconnect,

      To Int: Dev.

      Source Nets: IT Users and Prod,

      Dest Nets: Dev.

      Services: ALL.

      NAT: Disabled

    2:

      From Int: Dev,

      To Int: Interconnect.

      Source nets: Dev,

      Dest nets: All.

      Services: All.

      NAT: Enabled

Prod Fortigate:

  Interfaces:

    IT User subnet / VLAN

    Prod servers subnet / VLAN

  Static routes:

    Dev subnet via Dev Fortigate on Interconnect network

  Policies (In order):

    1:

      From Int: Any,

      To Int: Any.

      Source net: IT Users,

      Dest net: All.

      Services All.

      NAT: Disabled

    2:

      From Int: Interconnect,

      To In: IT User.

      Source Net: Interconnect,

      Dest Net: Single IT user IP.

      Service: Asterisk AGI.

      NAT: Disabled

    3:

      From Int: Interconnect,

      To Int: Prod Servers.

      Source Net: Interconnect,

      Dest Net: AD server IP.

      Services LDAP.

      NAT: Disabled.

Desired setup:

Dev Fortigate:

  Interfaces:
    Dev subnet / VLAN
    Interconnect subnet / VLAN

  Static routes:

    IT Users subnet via Prod Fortigate on Interconnect network

    Prod servers subnet via Prod Fortigate on Interconnect network
  Policies (in order):

   1:

      From Int: Interconnect,

      To Int: Dev.

      Source Nets: IT Users and Prod,

      Dest Nets: Dev.

      Services: ALL.

      NAT: Disabled

    2:

      From Int: Dev,

      To Int: Interconnect.

      Source nets: Dev,

      Dest nets: All.

      Services: All.

      NAT: Disabled <----

Prod Fortigate:

  Interfaces:

    IT User subnet / VLAN

    Prod servers subnet / VLAN

  Static routes:

    Dev subnet via Dev Fortigate on Interconnect network

  Policies (In order):

    1:

      From Int: Any,

      To Int: Any.

      Source net: IT Users,

      Dest net: All.

      Services All.

      NAT: Disabled

    2:

      From Int: Interconnect,

      To In: IT User.

      Source Net: Dev_Asterisk_Server_IP, <-----

      Dest Net: Single IT user IP.

      Service: Asterisk AGI.

      NAT: Disabled

    3:

      From Int: Interconnect,

      To Int: Prod Servers.

      Source Net: Dev_Keycloak_IP, <------

      Dest Net: AD server IP.

      Services LDAP.

      NAT: Disabled.

[HarshChavda]

Hello @rockking06 ,

Can you verify routing table on both firewall and verify that the static routes are correctly configured, also please check the firewall policy.  You can refer this document: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Routing-Issue/ta-p/195727

[rockking06]

Sorry I should of mentioned in the original post. I did check the routing table on both firewalls and saw the correct routes. Not sharing due to wanting to keep our IPs private.

Ping from dev to prod works with NAT enabled on the indecated policy above. Also I ran the policy lookup tool on both firewall and the correct policies were hgihlighted. So it's definately a routing issue not a policy issue.

[tpatel]

Hello Rockking, 

We need to run debug flow to checked how traffic is flowing  and what error we are getting. 
Can you please run debug flow which is mentioned in below KB article and provide us output. 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-filters-to-review-traffic-traversing...

[rockking06]

I ran diagnose debug flow on both firewalls at the same time filtered to an IT user IP and the dev postgres server. From what I can see in the traffic flows, everything seems to work without NAT, but the user cannot connect via PGAdmin. This is the same for every conenction between the firewalls regardless of protocol. As soon as I enable NAt on the dev Firewall outbound policy it all works again.

Do you have a way for me to share the traffic flow logs in an obfuscated or secure manner? I don't want to reveal the workings of our internal network on a public forum. :D