Problem with VIP / Port Forwarding

[championc1]

What am I missing here ?  My traffic is hitting my WAN address, but is not hitting the LAN.  First of all, this is on an old 90D that I am playing with, so it's on it's highest release of 6.0.18

I am trying to hit a server inside my network from the outside.  My ISP router is outside the Firewall, and has all ports Port Forwarded.  I can see the traffic hit my Firewall

Spirit-FW # diag sniffer pack any "port 22" 4 0 a
interfaces=[any]
filters=[port 22]
2024-10-20 20:10:27.049346 wan1 in 93.107.205.221.41489 -> 192.168.1.17.22: syn 3251867515 
2024-10-20 20:10:28.057670 wan1 in 93.107.205.221.41489 -> 192.168.1.17.22: syn 3251867515 

But it won't hit my inside LAN.  I have a fully open Any Src / Any Dst / All services rule in place

I have a Virtual IP for 192.168.1.17 --> 10.10.5.100 (TCP: 22 --> 22)

Doing a Packet Capture too confirms the traffic to the WAN, but never his the LAN Interface

I'm sure that this is something stupidly simple that I am overlooking :(

Thanks in advance

[AEK]

The policy should have the VIP object as destination, and LAN interface as destination interface.

[rahul_p1]

Hi,

Please refer to this article and make sure your configuration is correct :- How to configure VIP access where specifi... - Fortinet Community

[borlinjo1]

VIPs should only really be used for external access I've never used them for internal facing port forwarding. If you're trying to get internal to internal that's segregated via vlan then you just need a simple policy and route setup correctly from destination to destination. Throwing a VIP into the equation makes this a bit more complicated then it needs to be.