Please can some explain the below senario. These firewalls are on the same physical site, they share an interconnect VLAN / subnet that has nothing else on (better than a IPSEC VPN). I am in the process of segregating Dev from Prod, previously they were on the same firewall with a lot of over-lapping services. I want it to work using specific IPs as source on the Prod firewall and without NAT. But it wouldn't work and I don't know why. I have static routes in both directions, so I don't understand why this won't work without NATing. Any help is much appricated, Thanks!
Working setup:
Dev Fortigate:
Interfaces:
Dev subnet / VLAN
Interconnect subnet / VLAN
Static routes:
IT Users subnet via Prod Fortigate on Interconnect network
Prod servers subnet via Prod Fortigate on Interconnect network
Policies (in order):
1:
From Int: Interconnect,
To Int: Dev.
Source Nets: IT Users and Prod,
Dest Nets: Dev.
Services: ALL.
NAT: Disabled
2:
From Int: Dev,
To Int: Interconnect.
Source nets: Dev,
Dest nets: All.
Services: All.
NAT: Enabled
Prod Fortigate:
Interfaces:
IT User subnet / VLAN
Prod servers subnet / VLAN
Static routes:
Dev subnet via Dev Fortigate on Interconnect network
Policies (In order):
1:
From Int: Any,
To Int: Any.
Source net: IT Users,
Dest net: All.
Services All.
NAT: Disabled
2:
From Int: Interconnect,
To In: IT User.
Source Net: Interconnect,
Dest Net: Single IT user IP.
Service: Asterisk AGI.
NAT: Disabled
3:
From Int: Interconnect,
To Int: Prod Servers.
Source Net: Interconnect,
Dest Net: AD server IP.
Services LDAP.
NAT: Disabled.
Desired setup:
Dev Fortigate:
Interfaces:
Dev subnet / VLAN
Interconnect subnet / VLAN
Static routes:
IT Users subnet via Prod Fortigate on Interconnect network
Prod servers subnet via Prod Fortigate on Interconnect network
Policies (in order):
1:
From Int: Interconnect,
To Int: Dev.
Source Nets: IT Users and Prod,
Dest Nets: Dev.
Services: ALL.
NAT: Disabled
2:
From Int: Dev,
To Int: Interconnect.
Source nets: Dev,
Dest nets: All.
Services: All.
NAT: Disabled <----
Prod Fortigate:
Interfaces:
IT User subnet / VLAN
Prod servers subnet / VLAN
Static routes:
Dev subnet via Dev Fortigate on Interconnect network
Policies (In order):
1:
From Int: Any,
To Int: Any.
Source net: IT Users,
Dest net: All.
Services All.
NAT: Disabled
2:
From Int: Interconnect,
To In: IT User.
Source Net: Dev_Asterisk_Server_IP, <-----
Dest Net: Single IT user IP.
Service: Asterisk AGI.
NAT: Disabled
3:
From Int: Interconnect,
To Int: Prod Servers.
Source Net: Dev_Keycloak_IP, <------
Dest Net: AD server IP.
Services LDAP.
NAT: Disabled.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello @rockking06 ,
Can you verify routing table on both firewall and verify that the static routes are correctly configured, also please check the firewall policy. You can refer this document: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Routing-Issue/ta-p/195727
Sorry I should of mentioned in the original post. I did check the routing table on both firewalls and saw the correct routes. Not sharing due to wanting to keep our IPs private.
Ping from dev to prod works with NAT enabled on the indecated policy above. Also I ran the policy lookup tool on both firewall and the correct policies were hgihlighted. So it's definately a routing issue not a policy issue.
Hello Rockking,
We need to run debug flow to checked how traffic is flowing and what error we are getting.
Can you please run debug flow which is mentioned in below KB article and provide us output.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-filters-to-review-traffic-traversing...
I ran diagnose debug flow on both firewalls at the same time filtered to an IT user IP and the dev postgres server. From what I can see in the traffic flows, everything seems to work without NAT, but the user cannot connect via PGAdmin. This is the same for every conenction between the firewalls regardless of protocol. As soon as I enable NAt on the dev Firewall outbound policy it all works again.
Do you have a way for me to share the traffic flow logs in an obfuscated or secure manner? I don't want to reveal the workings of our internal network on a public forum. :D
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1710 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.