Output traffic with default route BGP

[danny1989]

Good morning everyone
I recently entered the fortinet world. I have a Fortinet-VM02 that gets the default route via BGP (configured on port3) from our main router. On another interface (port4) the static public IP announced via BGP is configured. Port4 is the WAN port that will provide connectivity to our servers. I have to let the traffic generated by the firewall itself (output) exit from the IP of interface 4 instead of 3 otherwise the firewall does not renew the license or other services that require internet.

the firewall obviously exits from 3 indicating the IP of interface 3 as the source address

The forward traffic is ok, the VMs connected under port 4 navigate with their static IP belonging to the /24 subnet announced via bgp, the problem is only the output traffic of the firewall itself.

thanks to whoever will answer me

[Toshi_Esumi]

Are you saying you don't want to send those FTGD destined packets out of port4, but want to advertise the subnet of the port4 IP is in to BGP neighbor connected over port3?

Toshi

[danny1989]

Exactly, the traffic must not go out from port4, I just have to use the IP of port4 but it could also be the IP of the Loopback (example)

[Toshi_Esumi]

You had to tell that clearly at the beginning. Everybody didn't get that and assumed you need to send them out over port4.

In that case, I'm assuming you're already advertising the subnet over BGP to get any packets from the outisde for that IP over port3. Then you just need to set the source IP as @vbandha explained.

config system fortiguard

    set source-ip <port4_ip>
end

After this all FTGT related packets initiciated by this FGT would use that IP as their source IP.

Toshi

[Toshi_Esumi]

By the way, those are not NATed but just set the specific IP for the source. No involvement of any policies. Policy(NAT) is only for packets coming through the FGT (in and out), not for self-initiated packets.

Toshi

[vbandha]

Hello @danny1989 

You mentioned this earlier:
'Exactly, the traffic must not go out from port4, I just have to use the IP of port4 but it could also be the IP of the Loopback'

This maybe tricky. If we do send the packet out port3 with Source IP as Port4 IP, how will the reply be received?

I don't think this type of setup would be possible. 

Also, you can't use private IP of loopback as source on the internet, it has to be a public IP. 

If you have IP pool of Public IPs on port3 let's say then we could use one of them as source and not use the port3 interface IP itself. 

Regards,

Varun

[Toshi_Esumi]

That's why I assumed the subnet was advertised by BGP to the neighbor through port3. And if it's not a public subnet, there have to be NAT in upstream device (or the nighbor).

Toshi

[vbandha]

If there is a modem upstream with public IP then the setup could work. 

Perhaps using Secondary IP on port3 and use that as source IP in fortiguard. 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Set-a-secondary-IP-on-a-FortiGate-interfac...

Or maybe creating an IP Pool with arp enabled and using that as source IP in fortiguard settings. This only works on specific FortiOS versions:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IP-pool-and-virtual-IP-behavior-changes-in...

Varun