Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
mlarcher
New Contributor

Port Forward or Service required for multiple ports to a single IP.

Using this as a guide:  http://docs.fortinet.com/uploaded/files/1652/using-port-forwarding-on-a-FortiGate-unit.pdf

 

It recommends creating a VIP with port forwarding enabled for each port I want to forward.  This seems like a ton of work considering we can add services with ports defined to the policy that is required.  I have tested on my 50E using 5.4.3 that creating a single VIP with a policy and multiple services is working, but is there something I am overlooking by NOT having port forwarding enabled on the VIP?

 

Thanks.

 

4 REPLIES 4
brycemd
Contributor II

Not specifying the ports would be the beginnings of a one to one NAT. This means you can only port forward that external IP to a single internal IP. If you specify ports you can use the external IP for multiple internal IPs(as long as the ports don't overlap).

 

For example, if you have multiple external IPs to use, you can do a VIP without specifying ports to an internal IP, then you could use the IP pool in the policy to have outgoing traffic use that IP as well. 

 

But, I guess to answer your question, there is nothing wrong without specifying the ports in the VIP... until you need to port forward to more internal IPs. Then you'll need to redo it.

rwpatterson
Valued Contributor III

The key here is: How many external IP addresses do you have or wish to use? If you only have one, port forward is your only option if you wish to publish multiple internal hosts. Also with the one to one, there is no longer the option to access the Fortigate as all ports are now sent to the inside host.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
mlarcher

So the ports are not restricted to only the ones in the attached service?  I am not adding "all" to the policy.

 

VIP = external ip (only one) > internal IP  no port forward configured.

Policy =  In: Wan1  Out: Lan (hw switch)

Source: all Dest: VIP object

sched: always Service: RDP

Nat: no

 

This configuration is working, I can still access the forgtigate, and access the server from the outside. I have another policy fwding another port to another internal server which is working, at the moment I have no need to have the same port go to different internal IPs.

 

Thanks for helping me understand this.

brycemd

You are correct that not everything will get in, only the things you allow via the policy. But, the external IP will be bound to the internal IP. This means that nothing else will work. For example managing the fortigate GUI remotely, ssl vpn, remote ssh... etc. Those all listen on ports that will now be directed to another IP.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors