Intranet (SOLVED)

[#1]

Hello, I need to know what type of policy or how do I go about setting up an Intranet for my office. I have my webservers on Subnet 1 and my Office is connected to Subnet 2. I would like for my office to be able to access a 2 websites that' s on one of my webservers via an Intranet before if the internet goes down they are still able to access these websites via the intranet etc. How do I accomplish this? The servers and the office is behind a FortiGate 60B firewall in Interface Mode. I have the latest firmware available on this unit.

[UkWizard]

I don' t quite follow you, could you elaborate

[#3]

ok basically what I want to do is have my employees access the a website on one of my servers via the ipaddress without going through the internet. In other words lets say my internet goes down in my office, I would like my employees to still be able to access a website in my office through the LAN or network.

[UkWizard]

Where is the intranet server? in the local lan or DMZ? This is more a DNS question, and sounds like its not really related to the firewall. Usually, for an intranet site, it should resolve to its own internal IP. thus not going through the firewall. Unless you have your users using a ISP DNS server instead of a local one, or your intranet has a VIP on it to an external IP, (which would make it an extranet) Sorry, need more info still, as question doesnt make sense as it is.

[#5]

I do not have an internal DNS server. The webserver is located on the DMZ. I have a VIP ponting to the server' s internal IP Address which is something like 10.10.10.10. My employees desktop computer are connected to Subnet 1. Basically I have 1 webserver connected to the DMZ port of the firewall and my employees desktop computer is connected to the Internal networks (port 1) on my firewall therefore the webserver and the internal networks is in the same office on 2 different subnets. I would like to have my internal users to be able to access the website on my webserver via the intranet therefore eliminating the need to access the website through the internet.

[#6]

Where is the intranet server? in the local lan or DMZ?

Ther server is on the DMZ and my network is on Interface 1.

[rwpatterson]

If you use the host file approach, set up a policy: Interface1 -> DMZ, client IP (192.168.50.x) -> 192.168.70.2 Don' t use the VIP address, no NAT.

[#8]

If you use the host file approach, set up a policy: Interface1 -> DMZ, client IP (192.168.50.x) -> 192.168.70.2 Don' t use the VIP address, no NAT.

I totally understand this but here' s the thing. I have one website on this same server that requires access to it from outside the network, in other words a public website. With that being said I have a VIP pointing to the IP Address of that server with NAT enabled. Do you think I can accomplish this by assigning each website on the server an Internal private IP of 192.168.2.10-3 and only mapping the VIP to the internal IP Address of the website that is public?

[UkWizard]

So do you have an external IP setup for the Intranet VIP? If so, then when the internet goes down it will still continue to work, but its probably the DNS thats stopping it working. I presume all your clients use an ISP DNS server(s), and you have a vip to resolve your ' intranet.yourdomain.com' . Yes? In which case its failing because of the fact you are using your ISPs DNS There is a couple of ways to resolve this; 1. Setup an Internal DNS server and use that for clients DNS settings. or 2. add a manual entry on the ' hosts' file of every desktop pc, pointing to the VIP OR the real IP. The latter is the easiest if you do not have many machines to configure. In reality, unless you need external access for the intranet server, then you wouldnt need a vip anyway. Just routing to the DMZ subnet would work....

[#10]

I tried modifying the hosts file but still no luck. Any ideas why that is not working? Again The Webserver that' s hosted the site is the DMZ (192.168.70.2) and the employees desktop computers is on the internal (192.168.50.1)