New Fortigate User: Need help with Watchguard Migration

[danseals]

Hello all, first time Fortigate user and need a little help. I'm upgrading from a Watchguard Firewall, the feature set on the 300D is impressive to say the least. 

Here is an example of a problem I am having trouble solving, and I think it's because I just don't understand how things are done on the Fortigate side:

I have 4 AWS servers (don't have contiguous IPs) that I need to allow authentication over LDAP-SSL to a server inside my network. Here is how I have it set up in Watchguard:

1) I create a 1-1 NAT for the server in question mapping an external IP to the internal IP of the server on my network. 

2) I create a rule with those 4 servers mapping to the external IP created in step 1 for port TCP port 636. 

3) I create a rule outgoing from the internal IP of my server, going to those 4 servers over the same ports. (reverse of step 2)

4) All other traffic is implicitly denied.

Now, attempting to recreate that in Fortigate:

1) I create an LDAP-SSL Service that is TCP on port 636.

2) I create each server as a destination, I leave them as not listed.

3) I create a destination group, and choose the 4 servers, then I leave that as listed. This allows me to quickly select them all at once (they always are referenced together)

4) Here I get stuck... I am not sure how to do 1:1 NAT or if that is even the best way to do it. For the purposes of this discussion, let's call my internal server IP 192.168.1.125.

I thought I had it working with VIPs, but when I turned the rule on, DNS stopped working. And I honestly couldn't figure out why. 

Any help would be greatly appreciated, thanks so much!

[Carl_Wallmark]

Hi, Im guessing you want to do a port forward. 1. Create a VIP 2. Dont use 1:1 NAT ( if you dont really have to) 3. Enter your public IP and then the internal IP 4. Check "port forward" and enter your port you wish to use. 5. Create a firewall rule with this VIP as destination address. For example: Wan1 -> Port1 -> source any -> destination (your vip) Service: LDAPS 6. Do not check NAT, otherwise you'll see the firewall IP in the logs.

[Carl_Wallmark]

If you want a specific server to have a different public IP on the internet, you can use IP-Pools, attach that on the outgoing rule when enabling NAT in the firewall rule.

[danseals]

What do you do if you have more than one machine that needs the same port forward? Would that be IP-Pools?

[Stu]

I have this same question.  The way I've done it previously was creating a ViP for each server...seems like a lot of work.

[rwpatterson]

There is no way to have four unique servers behind a single IP and port unless they are load balanced either in the firewall on in the server software. That being said, yes four different VIPs are required with the same IP and different ports or four different IPs with the same port (or any combination thereof).

[ede_pfau]

BUT....

you should pack all VIPs into a VIP group (aha!) and use that as the destination address in just one policy. As all these VIPs demand the same handling (more or less) it simplifies the policy table a lot when you use VIP groups.

[rwpatterson]

ede_pfau wrote:

BUT....

you should pack all VIPs into a VIP group (aha!) and use that as the destination address in just one policy. As all these VIPs demand the same handling (more or less) it simplifies the policy table a lot when you use VIP groups.

Touche. Agreed.