Open external access to a web server

[syldor]

Hi,

I have an internal web server with a fixed IP. 

The external access is provided by Fortinet router, with only one public IP for the whole network.

I want to allow external access to that server (and after multiple servers) with a DMZ and started to configure a DMZ interface, a virtual IP and corresponding policies as shown here:

http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/objects.067.08.html

However I have some questions:

- Is that method the good one for my use case ?

- When creating the virtual IP address, I have to put the external IP address. I just have one, so how can I manage the access to multiple internal web servers ?  

Many thanks, 

[gschmitt]

syldor wrote:

- Is that method the good one for my use case

Yes

- When creating the virtual IP address, I have to put the external IP address. I just have one, so how can I manage the access to multiple internal web servers ?  

Use different ports is the only option

[syldor]

Thanks gschmitt.

So it looks like I have to do both port forwarding and DMZ interface, but port forwarding was implicit in the video, when setup HTTP Virtual IP, I can put any port instead of 80:80.

[gschmitt]

syldor wrote:

So it looks like I have to do both port forwarding and DMZ interface, but port forwarding was implicit in the video, when setup HTTP Virtual IP, I can put any port instead of 80:80.

It's quite easy, go to Policy&Objects > Objects > Virtual IPs

Create a New virtual IP

External IP Address: YourExternalIP

Mapped IP Address: YourInternalServerIP

Port Forwarding checked

Protocol TCP (in case of webservers)

External Service Port 8080

Map To Port 80

Create a normal wan to internal policy from all to this VIP

Now if you try to access YourExternalIP:8080 you get forwarded to YourInternalServerIP:80

there is no DMZ interface on my fortinet unit. My webserver is connected to a switch that is connected to my fortinet unit.   Should I use one of the unattributed physical interfaces and physically connect my switch to it, and route data from the DMZ to the web server on my switch ?

You got two options:

Use any free single interface on the FortiGate. If you are in Switch Mode (all internal ports are connected) you can switch to Interface Mode and seperate them.

If your switch can do VLANs you can create a VLAN Interface on your existing FortiGate interface. (System > Network > Interface - Create New; VLAN; enter VLAN ID)

On the Switch simply add the port as a tagged port and the port the Server is connected to as an untagged port (or tagged if you enable VLAN on the NIC)

[syldor]

gschmitt i dont get the second option.

When you say "add the port as a tagged port", which port are you talking about ?

And for the first option, once in interface mode, I have to configure access from my DMZ interface to internet no ? So with a different public IP than the one of my current external interface ? 

Thanks

[gschmitt]

syldor wrote:

gschmitt i dont get the second option.

When you say "add the port as a tagged port", which port are you talking about ?

And for the first option, once in interface mode, I have to configure access from my DMZ interface to internet no ? So with a different public IP than the one of my current external interface ? 

The switch INTERFACE.

You can NAT different subnets (DMZ and internal) to wan on the same public IP if you want to

[syldor]

Another question:

there is no DMZ interface on my fortinet unit. My webserver is connected to a switch that is connected to my fortinet unit.

Should I use one of the unattributed physical interfaces and physically connect my switch to it, and route data from the DMZ to the web server on my switch ?

Edit: talk about the switch

[Raymond3]

Hi Team

I have an issue doing Virtual IP on fortigate version 7.2.4. 

does vip work on that version?