Port forwarding vs Static NAT in Virtual IPs

[#1]

To publish our websites behind our Fortigate unit, we initially used Static NAT in our Virtual IPs (VIPs) and then created the policies to publish the site and allow only HTTP and HTTPS traffic to them. We recently had occasion to make us investigate using Port Forwarding for our VIPs. Once we changed the VIPs to be Port Forwarding, I could no longer do a tracert to the public IP of any of our websites. It would hit the LAN IP of the Fortigate and then give me " Destination Host Unreachable" . I also could not reach some of our sites internally even though an nslookup correctly identified the public IP address they were using. Without the Static NAT, it' s like the public IP addresses are not bound to the NIC of the firewall. Has anyone else seen anything like this and, if so, how did you overcome it besides the obvious - use Static NAT?

[#2]

That was the case for any site we host where we don' t have internal DNS point it to the LAN IP of the server. For example, www.mysite.com worked internally because of our internal DNS. However, www.customersite.com didn' t work internally because of the lack of internal DNS resolution which is what prompted the tracert. Externally, the www.customersite.com was fine but unreachable from inside. Shortly after removing the static NAT VIPs, one of our own sites became unaccessible for external people. That was the strange thing. I could almost at that time understand the other issues, but not that one since the site in questions was setup and published like the other sites that were not having an issue.