Issue with Virtual IPs

[ICTServices]

I have a complex setup (with multiple levels of NAT), but put simply, my problem is this: When I create a Virtual IP for a server on the LAN (to allow incoming connections from a trusted partner network), that same Virtual IP seems to be used for all outgoing traffic from that server to the internet. My provider' s firewall only allows outbound traffic from our firewall, and so connectivity is blocked. Is it normal behaviour for a Virtual IP to be applied to outgoing traffic as well as incoming, or is there a setting I' ve missed that prevents this?

[goftari]

You mean to find a way to source NAT the incoming traffic from the Intranet interface on the Fortigate?

[goftari]

Solved! Hi Ede, Assuming there' s no outgoing traffic to the Intranet interface except the reply traffic, I did solve my problem by changing the priority for the static default route to the Intranet gateway to 1000. This way the other two default static routes to the Internet having a priority of 0 will participate in ECMP load balancing and the route to the Intranet will just be used to show the next hop for the reply traffic coming in from the Intranet interface

[ede_pfau]

Glad it worked out. And an ingenious way to have a static route (so that this traffic will not be discarded) and not use it (by high priority)! This is something not in the book, thanks for showing us.

[goftari]

Thanks for your time following up with me.