Loopback interface used to NAT LAN users

[Jaures]

Hello all,

I have a Fortigate configured as follow:

- WAN1 has a public IP (/30 facing the ISP device)

- i configured a loopback interface with a public IP (due to ISP settings, users have to be NATted to this loopback IP to be able to browse)

I have configured the corresponding Firewall policies, and LAN users can access the internet.

The issue i am facing is that the Fortigate itself cannot reach the internet.

Please any lead or advise on this?

Urgent!!!!!

Thanks,

Jaures.

[emnoc]

Why don't you just use a ip pool for the nat? On the fortigate not reaching the piblic internet; have you done a traceroute? do you have a route with the next-hop gateway that of the ISp ( /30 )

Once you figure out the routing issues, set you policies for internal traffic src interface dst interface (WAN) with nat enable and the address listed in the ip pool.

[Jaures]

Hello Emnoc, i am using ip pool for the nat (but i set the loopback IP as my pool) and my policy for internal traffic src interface (lan) dst interface (WAN) with nat enable is also using the address listed in the ip pool. My WAN interface is peering with the ISP with a /30 subnet. I have a route with the gateway being the IP address of the ISP device. When i traceroute internet from the fortigate, it goes through the ISP gateway. But as i have mentionned, LAN users are able to reach public internet.

The fortigate cannot.

Regards.

[Dave_Hall]

Jaures wrote:

But as i have mentionned, LAN users are able to reach public internet.

The fortigate cannot.

Hi Jaures. 

What Emnoc is referring to, is similarly documented in KB#FD31034. 

Can you clarify what you mean the Fortigate can not access the Internet?  If traceroute (to an outside IP address) works from the Fortigate CLI then it would seem the Fortigate just can not access the FortiGuard servers.  From the CLI can you ping a host by IP but not by FQDN?  If so then maybe you just need to set up a source-IP address under config system dns.

Haven't thought this out, but instead of using an IP pool [strike]or loopback interface[/strike], what is stopping you from adding this IP address as a secondary IP address on your WAN1 interface?

Edit: Thought a bit about it, I think you may still need to set up an IP pool.

[Jaures]

Hello Emnoc,

i am able to ping 8.8.8.8 when i source it from the loopback IP.

but i am unable to ping 8.8.8.8 or any other public IP or FQDN when i source it from the WAN1 IP.

This is understandable, since the ISP specifically has told me that the /30 subnet between my WAN1 and their device

is not routable through the internet.

i have a policy, from LAN to WAN1, with NAT enable, using the IP pool (Loopback IP). using this policy, LAN users are able

to reach internet. I assume that the Fortigate (having a LAN ip as well on the internal interface) should use that policy to reach the internet, but it is not doing so...

Is there anything i am missing? maybe a policy telling the fortigate to use the loopback interface?

thanks,

Jaures.

[emnoc]

juares

Try to set the  exec ping-options and source the loopback address as your source. Than do a ping to  8.8.8.8 from the loopback and the wan1 address and see if that fails or works. If it does, than you  know the  fortigate has access.

[emnoc]

OP 

I'm on the road with ppor  internal but to answer part of problems, you need to find the  thread about sourcing  local interfaces for forticloud/fortiguard/dns. Do a search for the last 3 months and you will find how to make the  FGT works with "another" interface.

If the isp  is not routing your  /30 than that would be the reasson for the loopback the reasons for your unable to ping the internet. If you should ever need to ping, use the exec ping-options and specifiy the interface that you want.

[Jaures]

Hello Guys,

Thank you for your replies.

I finally asked the ISP to provide me with a /30 subnet routable through the internet, which they did.

All is fine now. The Fortigate can reach internet through the WAN interface and can also reach Fortigard services.

Thanks...

Jaures.