Intranet internal ip address

[Gableon]

I have a public webserver that also has an intranet, my problem is that I need to know the internal computers ip address(local), when an internal users logs in, logs with the fortinet (ip address) I dont know the real user ip. Is there a way to configure this so I can see the users internal real ip? all users from outside (internet) are giving me their real ip address.

[ede_pfau]

hi, sounds like the policy from ' internal' to the interface the web server is on is using NAT. This should be unnecessary. If you disable NAT you will be able to log the original source addresses. Did I get you right?

[Gableon]

I checked the policy where the server is and does not have NAT and also checked the policy where I' m accessing through and neither has the NAT enable. Thanks for the reply Ede :=) good morning

[Gableon]

The policy from where we are accesing the server has NAT on, if I disable the NAT can' t access internet.

[ede_pfau]

OK, now we need some more info. Could you please post - the policy accessing the server - the ip addresses used (changed if you need to) - the interfaces involved You can best list the policy in the CLI (console) with ' conf fir policy' , ' show' I' m still convinced that this is a NAT issue but with as little information as now it' s bordering on crystal balling.

[romanr]

Hi, are you having your web-server placed internally on the same subnets as your clients and want to access it via the external address? Then this is not possible without NAT! br, Roman

[Gableon]

yes, the server is in the same subnet, we have two interfaces wan1 apps , vpn, voip etc, wan2 is the web interface, and yes we access the server vía web (wan2). It' s a public server. (we access internet from this interface)

[Gableon]

conf fir policy' , ' show'

this is the Policy for intranet server edit 68 set srcintf " wan1" set dstintf " internal" set srcaddr " all" set dstaddr " NAT_1??.2??.8?.1??" set action accept set schedule " always" set service " HTTP" " HTTPS" " intranet" set profile-status enable set logtraffic enable set profile " Servers" next

[ede_pfau]

Looks like this: - your internal hosts address the intranet server with it' s public IP address - this traffic is routed from internal to wan1 through a policy with NAT enabled; outgoing traffic will have the wan1 interface IP address as source address then. This has got to be like this - otherwise, the reply traffic couldn' t be routed back. - from wan1 traffic is entering the VIP ' NAT_1xx.2xx.8xx.1xx' and finally reaching the internal server. Two ways to have the internal source addresses visible: 1. in the outgoing policy, NAT not to the single interface address but to a 1:1 subnet range with public IP addresses (who' s got so many?) 2. address the intranet server with it' s private internal IP address - make the traffic ' internal' to ' internal' . If your users just use a FQDN then the FGT can translate the FQDN to the internal private IP address of the server (keyword: ' dnstranslation' ).

[Gableon]

sorry Ede how can I make that, I' m not an expert in Fortinet but trying to learn, like you say when we enter by the browser to our intranet we go out by wan2 (internet) then gets in by wan1 and redirect to his internal address, how can I make it internal to internal? I have already a virtual ip thats NAT that converts the outside ip(web) to the internal ip. Thanks in advance for your help.