Port forward 2 ports to the same destination

[#1]

I am trying to forward 2 ports (port 80 and 8088) to my webserver sitting on my inside network. The funny thing is only port 80 works and not 8088. I have created the Virtual IP as below Virtual IP for port 80 External interface: 10.0.0.130 Mapped IP: 172.17.17.1 Port forwarding checked TCP checked External Service port: 80 Map to Port: 80 Virtual IP for port 8080 External interface: 10.0.0.130 Mapped IP: 172.17.17.1 Port forwarding checked TCP checked External Service port: 80 Map to Port: 80 In the firewall policies for External to Internal I have allowed both port 80 and 8088 to be allowed. FortiOS is 2.8 Is there a limitation in Fortigate. such that I can only forward 1 port to each destination?

[RickP]

I am trying to forward 2 ports (port 80 and 8088) to my webserver sitting on my inside network. The funny thing is only port 80 works and not 8088.

You might consider setting up the virtual IP to not limit itself to specific ports. Just forward everything, and then set the policy to forward only those two ports. Make a new service (Firewall > Service) for port 8088 and then make a group (Firewall > Service > Group) for it and HTTP and specify this group as the service in the policy. I don' t know if it would work any better, but it should take no time to try...

[UkWizard]

I presume you done a typo with that config you showed, as you dont have port 8080/8088 (which one is it?) mentioned Rickp, On the incoming policies you would need two seperate policies, one for each VIP. Must admit, i have not tried this personally, i can do if this doenst resolve it.

[RickP]

ORIGINAL: UkWizard On the incoming policies you would need two seperate policies, one for each VIP.

I' m not sure I follow, UkWizard, why I' d need two policies, or even two VIPs. I' d just set up one VIP, to forward incoming traffic from 10.0.0.130 to 172.17.17.1, and then have a single external to internal policy to allow this, but limited to ports 80 and 8088. I wouldn' t use the VIP to restrict the traffic to specific port(s). Instead I' d use the policy for that. Granted I' m no expert, but this seems both logical, and simpler. Of course I may be missing something simple which invalidates my logic. It wouldn' t be the first time. :)

[UkWizard]

Its me being an idiot probably, i presumed he wanted two external ports to ONE internal port on the webserver. davekiat, If you want port 80 to 80 and 8080 to 8080, then you can either do what Rickp says above, or create two VIPS and create an policy for each VIP. Rickp is talking about using one STATIC nat VIP, for the entire external IP to this internal IP. and NOT using two Port-Forwarding based VIPS. But, if you want to use port-forwarding based vips, you have to set the destination on the policy to the VIP name, hence why two is needed. hope that makes sense.

[RickP]

hope that makes sense.

Complete sense, and thanks for your elaboration. It always amazes me that there are so many way to do things. The more I think about it, the less and less graceful my idea becomes. Two VIPs and two policies also allows for more flexibility. I hope the original poster chimes in because looking at his message (besides the port typos), it looks like his logic is sound. He does mention firewall policies (plural) for external to internal. If each specifies one VIP, it ought to be working.

[#7]

Hi guys, A typo error. My bad, it should be 8088. I want to port forward 2 different ports to the same destination ie. port 80 and 8088 to 172.17.17.1 port 80 and 8088.