Multi Wan Address

[yvan_rossier]

Hello,   I forget about the Forigate 60d (fortios 5.6) and I can not configure several external IP addresses (on the same WAN interface). The fault WAN is configured with an external address (46.20.145.200). I have 4 other external IP addresses that I would like to use to NAT on different internal server, for example: 46.20.145.202 - 192.168.1.201 (Special Port 23587) 46.20.145.203 - 192.168.1.202 (https) 46.20.145.204 - 192.168.1.203 (https) etc ... Idea?   Thanks

[ede_pfau · Accepted solution]

Yes, the Cookbook is an excellent source of information for the most common scenarios with your Fortigate. This specific recipe deals with port-forwarding VIP. As a first step, use a non-port forwarding VIP (just a plain one) to see that it works. Then add one VIP per port translation.

Please post the VIP definition and the custom service def for your port 23560 config.

[ede_pfau]

hi,

and welcome to the forums!

You can easily use the other public addresses by creating one VIP per address on the 'wan' interface. Now, create a policy with source IF 'wan', destination IF 'myVIP', addresses and the rest to your liking. The FGT will react on behalf of the internal host, that is, act as an arp proxy. From external hosts, a VIP on the FGT will exactly look like a 'real' host.

I would recommend not to use a port-forwarding VIP if you don't have to. A 'full' VIP will only exchange the destination address in each packet to the 'mapped' address; ports are unchanged. So, ping (portless protocol) will work as well, for testing.

If you want to narrow the port down then create a custom service and use that in the policy.

[yvan_rossier]

Thank you for this info but I learn :) do you have a more detailed procedure?

[ede_pfau]

hi,

it won't get more detailed...it's too simple for that. Just follow what I've written in the first paragraph and create a VIP. Then create a policy from WAN to LAN and use that VIP as the 'destination address'. That's all.

[yvan_rossier]

Hello,

this faq is good ? (http://cookbook.fortinet.com/port-forwarding/)

I tried following the instructions but it works for the https but not for a custom port (23560). I do not understand why. I also tried without the forwarding ports in the VIP but did not work for port 23560

Thanks

[ede_pfau · Accepted solution]

Yes, the Cookbook is an excellent source of information for the most common scenarios with your Fortigate. This specific recipe deals with port-forwarding VIP. As a first step, use a non-port forwarding VIP (just a plain one) to see that it works. Then add one VIP per port translation.

Please post the VIP definition and the custom service def for your port 23560 config.

[rwpatterson]

yvan_rossier@gestit.ch wrote:

Hello,

this faq is good ? (http://cookbook.fortinet.com/port-forwarding/)

I tried following the instructions but it works for the https but not for a custom port (23560). I do not understand why. I also tried without the forwarding ports in the VIP but did not work for port 23560

Thanks

In your custom service, open the source port range from 1024 (some use zero, I don't) to 65535. That should enable it to work properly.

[yvan_rossier]

Hello,

ok, try.

Just an info on the my configuration. My internet access works, for working, i have added a static route for the Gateway "0.0.0.0/0"  "external gateway ip"  "WAN1" (Required for my provider)

Add VIP: "External IP address" "internal server address"

Add IPV4 Policy: "Name" "WAN" "Internal" "ALL" "VIP name" "Always" "HTTPS and personal service port 23560)

Personal port: "Name" TCP/UDP/SCTP" "Address Ip range 0.0.0.0" "Destination port" TCP 2360-High 

https working and no personal port (23560) :(

Thanks

[yvan_rossier]

i find solution, Firewall / Network NAT Options enlabled, juste disabled and working :)

Other question, It is possible with the VIP to have another internal IP?

On an external IP I have 2 different services on 2 internal server? By adding a new VIP with the same external IP I have the message that it already exists. A solution ?

Thanks

[ede_pfau · Accepted solution]

You can have only 1 non-portforwarding VIP for one external address but multiple if you port-forward.

If you create multiple VIPs to reach multiple internal servers or one server via multiple services then you may create a VIP group and use this as the 'destination address' in the policy. It's a bit cleaner.