Port forwarding newbie questions

[#1]

Hi. i' m new to fortigate and just can' t figure out how to do regular port forwarding. I have an older Fortigate 60 on version 3 of the OS (i have to clue how to figure out what release). Anyway, i just can' t figure out how to port forward from one external IP to the internal network. I have two servers. One is 192.168.1.1. I need all external port 80 traffic to go to port 80 on that server. The second server is 192.168.1.2. I need port 81 traffic to go to port 81 on that second server. HOW?!?!?!? I tried setting a vip for each server but i get duplicate entry errors. I just try to use the firewall policies and get no where. I' m just looking for simple port forwarding like a regular home router does! Any added security tips to this scenario would be helpful too but i just need it up and running. Thanks

[ede_pfau]

Hi, and welcome to the forums! 1. Your FortiOS version is displayed on the command line (CLI) with

 get sys stat

2. You are right in assuming that you need VIPs for port forwarding. If you get a ' duplicate address' error then you haven' t configured both VIPs for ' static NAT port forwarding' . You need to forward port 80 to port 80, and port 81 to port 81. You can specify the same source IP address (your WAN IP) and even the same internal IP address. But in your case the internal address will be .1 on the first VIP, and .2 on the second. Be aware that you will get a problem here. By default the Fortigate itself will listen on port 80 for HTTP requests to its WAN interface (or at least this could be enabled). Solve this conflict by moving the management port to any other ' high' port like 8080. You find that in System>Admin>Settings. 3. Security tips: narrow down the service you allow in the policy WAN->internal to the one you are forwarding. Port 80 translates into ' HTTP' (predefined service), port 81 is non-standard. You can define your own port81 custom service and specify that in the policy. Like with all port forwarding VIPs, your VIPs will not forward ICMP, i.e. ping! So don' t bother if your servers don' t respond to ping. 4. Get the FortiOS Handbook version 4.00 from http://docs.fortinet.com . Even if your firmware version is (a lot) older than that you will get the basics, examples and concepts of FortiOS. Without reading on the documentation you will have a hard time running this sophisticated firewall. HTH.