Intranet (SOLVED)

[#1]

Hello, I need to know what type of policy or how do I go about setting up an Intranet for my office. I have my webservers on Subnet 1 and my Office is connected to Subnet 2. I would like for my office to be able to access a 2 websites that' s on one of my webservers via an Intranet before if the internet goes down they are still able to access these websites via the intranet etc. How do I accomplish this? The servers and the office is behind a FortiGate 60B firewall in Interface Mode. I have the latest firmware available on this unit.

[UkWizard]

You shouldnt need to use VIP' s, why do you need to do that? How is it currently setup? are you saying you then have two websites, one external and one intranet, on the one server. If so, are you using two different listening ports? as the alternative is using different IP addresses on the server itself. So say the external one listens on the real server IP. And then use another IP for the intranet to listen on. Internal DNS should resolve to the relevant IP its listening on, you shouldnt have to use VIPs for internal access. But obviously it can be done. Multiple external VIP' s would work as well.

[rwpatterson]

The server should already have a virtual mapping to the address at 192.168.70.2. The outside world will see your server via the Virtual IP mapping. At the same time, your inside clients will see the real IP addresses. Both will work simultaneously. After reading the above post, is the outside server and inside server the same physical box?

[#4]

After reading the above post, is the outside server and inside server the same physical box?

Yes it is. Again I have only 1 webser and it is hosting multiple websites ok. One of the 3 websites are public and the other 2 I would like to have accessible only to our LAN (Intranet). I have a VIP mapped to the Public website only but not to the 2 website that I would like to have on the Intranet only. I do not have a DNS server on my LAN therefore I can' t do this with DNS. I was hoping to either do it my adding an entry in the hosts file of each computer or by just having the users on the LAN type in the local IP address of the website (192.168.2.71) for each of the intranet websites. My Fortigate 60B is in Interface Mode and the Webserver (websites) is connected to the DMZ and my LAn is connected to Interface 1 on the same Fortigate firewall. How so I setup 2 websites to be accissible only via the LAN?

[rwpatterson]

If each server has it' s own IP, follow what I wrote above. Create a policy allowing the local users to the intranet web servers.

[#6]

If each server has it' s own IP, follow what I wrote above.

The server has 3 IP' s 192.168.2.70-72. I have a VIP mapped to IP 192.168.2.70 because this is my public website. The other 2 websites that is on the same server one is 192.168.2.71 and the other is 192.168.2.72 and there' s no VIP for these 2 IP' s. I' ll give this a try. This is from one of your post: f you use the host file approach, set up a policy: Interface1 -> DMZ, client IP (192.168.50.x) -> 192.168.70.2 Don' t use the VIP address, no NAT.

[UkWizard]

Yes thats correct, you literally just need policies to allow the traffic, either to the individual Ip addresses, or just to the entire subnet. Ie. you could just alllow all internal to all DMZ. Then use the IP addresses in the URL of the browser. A nicer way, is to add a couple of url redirects on the external facing website. For example, if your external website url is www.mysite.com, create a couple of redirectors on the website like; www.mysite.com/intranet & www.mysite.com/portal and have them redirect to the ip addresses (ie http://192.168.2.71 and http://192.168.2.71 ) Then your users do not have to remember the ip addreses and you can change them to redirect somewhere else later if needed. Hope thats make sense, in summary create a folder called intranet and portal under the root of the public facing website, with the default web file doing the url redirect. Really though, you should have intranet servers on seperate servers and preferably on the internel network. Else, if the external facing website got hacked, they would have access to your intranet websites as well.

[#8]

Thank you UKWizard for all of your help. The solution you provided below worked fine: I' ll give this a try. This is from one of your post: f you use the host file approach, set up a policy: Interface1 -> DMZ, client IP (192.168.50.x) -> 192.168.70.2 Don' t use the VIP address, no NAT. I do understand the redirect method you speak of but I was able to get it to work by modifying the host file therefore they will be able to get to the website by typing in the name. I also agree that I should have the intranet websites on a seperate server incase the public website gets hacked somehow but I have limited server' s to work with. Thanks again