Using this as a guide: http://docs.fortinet.com/uploaded/files/1652/using-port-forwarding-on-a-FortiGate-unit.pdf
It recommends creating a VIP with port forwarding enabled for each port I want to forward. This seems like a ton of work considering we can add services with ports defined to the policy that is required. I have tested on my 50E using 5.4.3 that creating a single VIP with a policy and multiple services is working, but is there something I am overlooking by NOT having port forwarding enabled on the VIP?
Thanks.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Not specifying the ports would be the beginnings of a one to one NAT. This means you can only port forward that external IP to a single internal IP. If you specify ports you can use the external IP for multiple internal IPs(as long as the ports don't overlap).
For example, if you have multiple external IPs to use, you can do a VIP without specifying ports to an internal IP, then you could use the IP pool in the policy to have outgoing traffic use that IP as well.
But, I guess to answer your question, there is nothing wrong without specifying the ports in the VIP... until you need to port forward to more internal IPs. Then you'll need to redo it.
The key here is: How many external IP addresses do you have or wish to use? If you only have one, port forward is your only option if you wish to publish multiple internal hosts. Also with the one to one, there is no longer the option to access the Fortigate as all ports are now sent to the inside host.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
So the ports are not restricted to only the ones in the attached service? I am not adding "all" to the policy.
VIP = external ip (only one) > internal IP no port forward configured.
Policy = In: Wan1 Out: Lan (hw switch)
Source: all Dest: VIP object
sched: always Service: RDP
Nat: no
This configuration is working, I can still access the forgtigate, and access the server from the outside. I have another policy fwding another port to another internal server which is working, at the moment I have no need to have the same port go to different internal IPs.
Thanks for helping me understand this.
You are correct that not everything will get in, only the things you allow via the policy. But, the external IP will be bound to the internal IP. This means that nothing else will work. For example managing the fortigate GUI remotely, ssl vpn, remote ssh... etc. Those all listen on ports that will now be directed to another IP.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1632 | |
1063 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.