Hi All,
Have you encountered this scenario?
I am using a FortiOS 5.4.3, FG300D, an Allow any internal user OUT, Natted to the firewall interface IP.
There is also an inbound rule for a specific user/device using a VIP that is not the interface IP.
Whenever that specific device is accessing the internet (outbound) that IP is natted to its VIP ip instead of the interface IP.
There is no IP pool configured on the firewall and there is no special rule for that specific device to go out. Firewall logs is saying it is being sourcenatted and the action made is timedout.
Would you know the proper way to fix this?
TIA
-Lehac
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
The cli cmd diag debug flow is your friend. Inspect your fwpolicy and take action on what's present or not.
Ken
PCNSE
NSE
StrongSwan
Hi Emnoc,
Yup I've done that and the firewall is just dropping the packet saying status "timedout"
it's just wierd that the the outbound rule is source natted to a VIP ip address even though the firewall policy is saying use the interface IP. That VIP ip is not even configured as an IP pool and not used for any outbound traffic.
I am just crowdsourcing if this is a pretty common behaviour on a Fortigate firewall
-lehac
That does not make sense, the diag debug flow should a match or deny . Can you post the output ( debug ) and the fwpolicy(s) involved? ( the output of deiag debug flow and where it says SNAT and the full firewall policy
e.g
show full firewall policy <xxxx>
show full firewall vip < xxxxxxxxxxxxxx>
Xs = policyid# and or name as it related to vip
)
So in your case, you have a DNAT-VIP being matched on outside traffic ? and that timeout ? Also do you have set set nat-source-vip enable on the VIP or central nat?
PCNSE
NSE
StrongSwan
Hi All,
The inbound DNAT-VIP is working fine but its just weird that the outbound traffic for that specific internal server is natted to the public IP used on that VIP. Even though the outbound policy says use the interface IP.
i'll post the debug after this.
-lehac
do a show full | grep 166. do you have that configured in the firewall.
PCNSE
NSE
StrongSwan
Hi Emnoc. 166 is just used for the inbound VIP, no IP Pool, no outbound rules for it. A colleague indeed confirmed that this has been resolved by removing the one-to-one VIP on a previous issue.
what does the VIP do for the inbound traffic?
have you tried to create a outbound policy just for the single source and put it highest in the sequence? if so what happens?
Can you post a debug output?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.