Looking for help with a hairpin route/policy

[dan231]

Setup: Internal MS Exchange Server FortiWIFI (vlan'd from the internal network for guest access to the Internet) Fortigate FW Iphone with ActiveSync email access to MS Exchange   Internet = WAN1 Internal Network = WAN2 Public-WIFI = VLAN on WAN2 VIP = External IP --> Mail server (any int)   I have all my routes and policies setup so from my iPhone I can get WIFI internet AND not see any internal devices. The problem is that I cannot get email access on my iPhone.  I now have a hairpin that I believe should work but doesn't.  From my iPhone, I can ping my mail server by name, but a tracert stops at the first hop: the FortiWIFI.   Current Hairpin policy: Public-WIFI (VLAN on WAN2) --> WAN2 (internal) with Destination of my VIP   I've been stuck at this for over a week and I can't wrap my head around this. I have a support ticket open and have reviewed the Fortigate docs on hairpin set.

[dan231]

2017-04-28 10:13:15 id=20085 trace_id=137 func=print_pkt_detail line=4793 msg="vd-root received a packet(proto=6, MailserverIP:443->192.168.201.3:52631) from internal. flag [S.], seq 1020708212, ack 2966908897, win 8192" 2017-04-28 10:13:15 id=20085 trace_id=137 func=vf_ip_route_input_common line=2586 msg="find a route: flag=04000000 gw-192.168.201.3 via Guest WiFi" 2017-04-28 10:13:15 id=20085 trace_id=137 func=fw_forward_dirty_handler line=324 msg="no session matched"

  This is from my FortiWIFI.  192.168.201.3 is my iphone.  Does this state it can't route back from my mailserver to my vlan?

[rwpatterson]

For a quick test, try enabling NAT on that policy.

[dan231]

I 've done NAT and NO NAT previously.  That has no affect

[rwpatterson]

By some chance, are the two subnets (WiFi and internal) in the same subnet range?

[dan231]

No.  the WIFI is it's own VLAN

They are both on WAN2, though, but I don;t think that should matter.

Since I see no email traffic, I am leaning that my hairpin is still wrong somehow.

[rwpatterson]

dan231 wrote:

No.  the WIFI is it's own VLAN

They are both on WAN2, though, but I don;t think that should matter.

Are you using WAN2 as a trunk port? Can you traceroute from the WiFi to see the traffic path?

[dan231]

Not sure on truck port meaning

Traceroute is one hop, since the outgoing ip is the mailserver IP.

So it recognizes that my mail server is ABC, so it doesn't look any farther in the Internet for more info.Which would mean it dies right here.  Would I need something to route the traffic to the VIP then?

Which should be my hairpin policy, yes?

Should my hairpin be on the FortiWIFI then?

[dan231]

YES!!!

I've got it!  I added the hairpin at the FortiWIFI and BOOM!  Works.

Thank you all as I would never have gotten this far without your suggestions/guidance.

[rwpatterson]

dan231 wrote:

Should my hairpin be on the FortiWIFI then?

This is the only place your hairpin should have been. This is the gatekeeper between the Internet and your LAN. Glad you're up and running.

[dan231]

I would agree..but then here we are... LOL