Hi, How to SSH to cisco switches inside network of Fortigate through the internet?

[clintz]

Hi, I have cisco switches connected to my fortigate fw at work and I want to remote them through the internet like for example at my home. How to configure port forwarding on fortigate? If for example my office public ip is 1.1.1.1 and my home public ip is 2.2.2.2 and my 3 cisco switch management ip is 10.0.1.1, 10.0.2.1 and 10.0.3.1. How can I configure my fortigate firewall to allow ssh remote connection from my house?

[atakannatak]

Hi @clintz ,

Below is the simplest layout—each internal switch gets its own TCP port on the FortiGate’s public IP. You restrict the source to 2.2.2.2 /32 so no one else on the Internet can try.

Step-by-step on the FortiGate

1- Define the source address (your home IP)

(GUI: Policy & Objects ▶ Addresses ▶ New)

https://docs.fortinet.com/document/fortigate/7.0.0/ngfw-deployment/680739/creating-address-objects

config firewall address
edit Home-IP
set subnet 2.2.2.2 255.255.255.255
next
end

2- Create one Virtual IP (VIP) per switch

(GUI: Policy & Objects ▶ Virtual IPs ▶ New)

https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/446182/virtual-ip-with-servi...

config firewall vip
edit Sw1-SSH
set extip 1.1.1.1 # or “interface” if your WAN is PPPoE
set extintf "wan1"
set extport 2221
set mappedip 10.0.1.1
set mappedport 22
set protocol tcp
next
edit Sw2-SSH
set extip 1.1.1.1
set extintf "wan1"
set extport 2222
set mappedip 10.0.2.1
set mappedport 22
set protocol tcp
next
edit Sw3-SSH
set extip 1.1.1.1
set extintf "wan1"
set extport 2223
set mappedip 10.0.3.1
set mappedport 22
set protocol tcp
next
end

3- Add one WAN→LAN policy that covers all three VIPs

(GUI: Policy & Objects ▶ Firewall Policy ▶ New)

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Create-a-firewall-policy-using-a-Virtual-I...

config firewall policy
edit 0
set name "SSH-to-Switches"
set srcintf "wan1"
set dstintf "lan"
set srcaddr "Home-IP"
set dstaddr "Sw1-SSH" "Sw2-SSH" "Sw3-SSH"
set schedule "always"
set service "SSH"
next
end

These configuration helps through the exact VIP and policy configuration used to expose your internal Cisco switches over SSH while limiting access to your own public IP.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

[GauravPandya]

Hi,

There are 2 options.

1. Take SSH of fortigate firewall and from there SSH to cisco switches with command "execute ssh admin@10.0.1.1". 

2. Create a VIP and use IP and port forwarding option for all 3 switches. Please note use different ports other than usable ports. External IP should be FW WAN IP, map it to cisco switch with port forwarding.