Port Forwarding problem

[Comtex_Tech]

I am brand new to using the Fortigate and the methodology used is a bit confusing to me.  The Fortigate is running v6.2.3 build1066 (GA) and I apparently can't update that since I don't have an active subscription?

The Fortigate is 192.168.1.1

I have set up a Virtual IP on interface (any) with external IP 10.10.10.10 and internal IP 192.168.1.2.

I created an Address of My Device, with IP 192.168.1.2 on interface (lan).

I created a Service of My Forwarding with Protocol type: TCP, address 192.168.1.2, Destination Port: TCP 12345.

I created a policy called My Device Policy.

  Incoming Interface (wan)

  Outgoing interface (lan)

  Source (all)

  Destination My Device

  Service My Forwarding

  Action Accept

Everything else in there is default.

When I attempt to use my connection program, the connection doesn't complete.  I've searched online and I found an article that said to use the debug flow to verify that the Fortigate is handling the forwarding properly; however, when I use the steps given to turn on debug flow, I get no information back from the Fortigate when I am using my connection program.

So, is my setup for port forwarding correct?  And what's the best way to troubleshoot this?

[Toshi_Esumi]

If the VIP's name is "MY Device", looks ok to me. I would either you create another VIP for "ALL_ICMP", then either swap it with the current one or put both in a VIP Group and use the group for the policy so that you can test it easily.

If ping works but TCP 12345 doesn't, likely the VIP itself is working but the device with 192.168.1.2 doesn't like what it's getting or having problem with replies. Then I would sniff at the device with like Wireshark to see what might be the problem. I would use "flow debug" after that point when I know the direct cause.

Depending on the model/size of FGT you have, the support isn't too expensive to be able to download a newer firmware like 6.2.10.

Toshi

[ede_pfau]

You need to use the VIP in as the 'destination address' in the policy, not the address object. You don't need an address object for this at all.

As far as I understood your description, the VIP is not port-forwarding. That is OK, make it simple in the beginning, use a VIP which is forwarding everything from WAN to LAN. You will then limit the desired traffic in the policy.

With a non-port forwarding VIP, ping will work. Just allow "Ping" as an additional service in the policy, as already mentioned by @Toshi_Esumi .

Why would you associate a simple address object with an interface (here 'lan') but associate a VIP with the 'any' interface? The VIP is meant to work on the 'wan' interface, and only there. Whereas the address is better not tied to an interface, for various reasons.

If you really use the FGT and need upgrades, get at least a FortiCare contract which covers firmware updates and HW replacement.