Port Forward or Service required for multiple ports to a single IP.

[mlarcher]

Using this as a guide:  http://docs.fortinet.com/uploaded/files/1652/using-port-forwarding-on-a-FortiGate-unit.pdf

It recommends creating a VIP with port forwarding enabled for each port I want to forward.  This seems like a ton of work considering we can add services with ports defined to the policy that is required.  I have tested on my 50E using 5.4.3 that creating a single VIP with a policy and multiple services is working, but is there something I am overlooking by NOT having port forwarding enabled on the VIP?

Thanks.

[brycemd]

Not specifying the ports would be the beginnings of a one to one NAT. This means you can only port forward that external IP to a single internal IP. If you specify ports you can use the external IP for multiple internal IPs(as long as the ports don't overlap).

For example, if you have multiple external IPs to use, you can do a VIP without specifying ports to an internal IP, then you could use the IP pool in the policy to have outgoing traffic use that IP as well. 

But, I guess to answer your question, there is nothing wrong without specifying the ports in the VIP... until you need to port forward to more internal IPs. Then you'll need to redo it.

[rwpatterson]

The key here is: How many external IP addresses do you have or wish to use? If you only have one, port forward is your only option if you wish to publish multiple internal hosts. Also with the one to one, there is no longer the option to access the Fortigate as all ports are now sent to the inside host.

[mlarcher]

So the ports are not restricted to only the ones in the attached service?  I am not adding "all" to the policy.

VIP = external ip (only one) > internal IP  no port forward configured.

Policy =  In: Wan1  Out: Lan (hw switch)

Source: all Dest: VIP object

sched: always Service: RDP

Nat: no

This configuration is working, I can still access the forgtigate, and access the server from the outside. I have another policy fwding another port to another internal server which is working, at the moment I have no need to have the same port go to different internal IPs.

Thanks for helping me understand this.

[brycemd]

You are correct that not everything will get in, only the things you allow via the policy. But, the external IP will be bound to the internal IP. This means that nothing else will work. For example managing the fortigate GUI remotely, ssl vpn, remote ssh... etc. Those all listen on ports that will now be directed to another IP.