Publishsing multiple Web sites using FortiGate and FortiWeb and only one public IP

[salam]

Hello everyone,

I have a single IP address on which I'm going to publish multiple websites.

IP is set on one of Fortigate's interfaces. How can I tell FortiGate to:

External DNS:

aaa.test.com -> My Public IP1

bbb.test.com -> My Public IP1

ccc.Hello.com -> My Public IP1

1. DNAT "https://aaa.test.com" To "192.168.1.50"

1. DNAT "https://bbb.test.com" To "192.168.1.60"

3. DNAT "http://ccc.hello.com" To "192.168.1.70"

*192.168.1.50,60,70 are VIPs on FortiWeb. It should send traffic destination-ed to each VIP to desired web server.

* All client's requests must point to default HTTPS port. All web servers also must only listen over default HTTPS port.

[akileshc]

Hello Salam,

To achieve this configuration on FortiGate, follow these steps using FortiGate's Virtual IPs (VIPs) and Firewall Policies:

1. Create VIPs: Each VIP entry maps the incoming requests on the specified external IP (your public IP) to the designated internal IP (192.168.1.50, 192.168.1.60, or 192.168.1.70). Make sure to enable port forwarding to map HTTPS (port 443) to the same port on the internal servers.

2. Set Up Firewall Policy: After creating the VIPs, set up corresponding firewall policies to allow HTTPS traffic from the external interface to each VIP.

Here’s the refined VIP Configuration:

config firewall vip
edit "aaa"
set extip x.x.x.x # Public IP on FortiGate
set mappedip "192.168.1.50" # Internal IP for aaa.test.com
set extintf "any"
set portforward enable
set extport 443
set mappedport 443
next
edit "bbb"
set extip  x.x.x.x # Public IP on FortiGate
set mappedip "192.168.1.60" # Internal IP for bbb.test.com
set extintf "any"
set portforward enable
set extport 443
set mappedport 443
next
edit "ccc"
set extip x.x.x.x # Public IP on FortiGate
set mappedip "192.168.1.70" # Internal IP for ccc.hello.com
set extintf "any"
set portforward enable
set extport 443
set mappedport 443
next
end

Firewall Policy Configuration

Once VIPs are configured, create firewall policies to allow traffic:

config firewall policy
edit 1
set srcintf "wan" # Adjust to match your external interface
set dstintf "lan" # Adjust to match your internal interface
set srcaddr "all"
set dstaddr "aaa" # Reference the VIP for aaa.test.com
set action accept
set schedule "always"
set service "HTTPS"
set logtraffic all
next
edit 2
set srcintf "wan"
set dstintf "lan"
set srcaddr "all"
set dstaddr "bbb" # Reference the VIP for bbb.test.com
set action accept
set schedule "always"
set service "HTTPS"
set logtraffic all
next
edit 3
set srcintf "wan"
set dstintf "lan"
set srcaddr "all"
set dstaddr "ccc" # Reference the VIP for ccc.hello.com
set action accept
set schedule "always"
set service "HTTPS"
set logtraffic all
next
end

This setup directs traffic based on the VIP configuration and ensures each request is routed correctly over HTTPS.

[salam]

Dear @Akilesh ,

Thanks for replying.

In your setup, all configurations were based on IP. How Forigate distinguishes the matching VIP and passes the request to desired web server? Because incoming packets are identical from layer 2 to layer 4 (traffic matches the higher rule and never gets to next ones)

[akileshc]

Hello Salam, 

To differentiate connections or route traffic specifically to various internal servers offering different services, the extport must be configured identically in your case. In the example specified above, the extport has been mistakenly set to 443 for all VIP entries.

[salam]

This is where my question crops up :)

All services must be over default HTTPS port ( TCP 443), so client are not forced to enter specific port for different URLs. As you know, user experience is truly important for businesses, indeed asking customers to memorize a custom port is not a good idea. Imagine, your banners around the city showing :

" visit us at www.aaa.test.com:8443 " . It seems to be a fake company :))

[Marthen2]

Hello, 

this will NOT work because in request was only one public IP and only default port 443.

So it must be only portforwarded on Fortigate to Fortiweb. 

On Fortiweb must be configured content routing based on host names.