Issue with VIP

[edgeman]

Hi Everyone,

I have a problem that someone may be able to help me with / point me in the right direction. I come from a Sonicwall background so this may just be terminology that is throwing me :)

I've searched the forum and tried a few things but can't get past my VIP issue, namely that the port 25 VIP that I set up is not sent on to the mail server.

I have set up a VIP, a policy, according to the cookbook, on my 60C (4.0) with an external ip of 0.0.0.0 (it's dynamic / dhcp delivered), internal IP of my mail server (private net), port forwarding on and TCP port 25 specified in the external and map to port fields.

My policy has the source interface as wan1, source address "all", destination interface of internal and destination address my VIP. Schedule is always, service is SMTP and Action is ACCEPT (and no NAT).

Problem is nothing gets through. I can telnet from the firewall (SSH) to the mail server on port 25, but when I try it from an external internet host I see lots of "wan 1 in" records (diag sniffer packet any "tcp and dst port 25" 4) but nothing ever out to the mail server.

The mail server is on the same subnet as the firewall's internal interface, and the firewall is running in NAT mode. I can ping from the mail server to the external internet test host, so connectivity seems to be fine.

Thoughts?

Thanks!

[ede_pfau]

hi,

and welcome to the forums.

At first glance your setup looks correct.

In the policy, do you really use the VIP object?

What if..you disable port forwarding, does it work then? An additional benefit of this is that you can now ping the server through the VIP (no portless ICMP through port-forwarding VIPs).

Which firmware are you using - main is 4.0, MR is ?, patch ?  (or just the build #).

[rwpatterson]

Beware, you can only remove the port forwarding if no other VIP definitions are using that same external IP (0.0.0.0 in this instance).

[Ralph1973]

Hi, can it be that your isp is blocking smtp ? Some providers do that, to prevent you run your own mailserver. Test it with a different port, since your setup looks correct.

Ralph

[edgeman]

Hi, and thanks for the welcome :)

The FortiOS version is: v4.0,build5907,120604 (MR2)

Bought off ebay, just waiting for the transfer to come through so that I can register it and get the latest firmware. I did a factory reset of course.

Attached is the firewall policy screenshot of what I have done.

Does the device have some sort of UTM functions that could interfere with port 25?

[edgeman]

No problem, I only have the one VIP and policy from wan to internal :)

[edgeman]

This was working on my sonicwall, so the ISP is definitely not getting in the way (thankfully) :)

Tried some other ports too, like TCP 1352 to make sure, same result.

Thanks for replying :)

[JohnAgora]

Some diagnose debug flow will give more insight on what is happening.

Try to run:

diagnose debug reset #Reset debug

diagnose debug enable #Show debug

diagnose debug flow filter addr <IP of mail server or from IP accessing the service> #Filter by IP

diagnose debug flow trace start 20 #Start debug

if needed:

diagnose debug flow filter port 25 #Filter by port

By the way, you have proper routing?

If you still don't find the answer with the debug,you can share it here.

[ede_pfau]

No, UTM cannot interfere as you've got none enabled in the policy.

As a quick test, change the VIP to non-port forwarding, open up the service in the policy to ANY (or is it ALL?? ancient fw version), and test with ping. Tighten the screws from there.

[edgeman]

ede_pfau wrote:

No, UTM cannot interfere as you've got none enabled in the policy.

As a quick test, change the VIP to non-port forwarding, open up the service in the policy to ANY (or is it ALL?? ancient fw version), and test with ping. Tighten the screws from there.

Cool, just wanted to check. Very strange things going on once I remove port forwarding.. Basically a ping from the Internet hosts works at that point! But any other TCP ports (have tried 25, 80, 443, 1352 now) do not work. However I can see the requests hitting the Fortigate in debug mode, it's just not passing them on.

The unit registration should be transferred to me shortly so that I can get the latest Firmware, at least in the 4.x stream, and I'll be purchasing support I think :)

I'll post back here when I have the firmware updated.

Thanks to you (and others) for assistance so far, appreciate the help :)