Request for Site Access via Specific Port

[ATOON]

Hi,

Assistance with a network configuration. We have two internet modems in our current setup:

1. A fiber connection linked to the Forti WAN port.
2. A DIA with a static IP connected to Forti port number 4.

The internet is functioning correctly from the WAN port, now we need the user login to specified sites accessed exclusively through port number 4.

Modem: FortiWiFi 30E

Firmware: v6.2.15 build1378 (GA)

[Toshi_Esumi · Accepted solution]

So far looks fine. Can you ping "fast.com"? Since I can ping it from my 40F, you should be able to. If not, try traceroute.

fg40f-utm (root) # exe ping fast.com
PING fast.com (23.5.241.75): 56 data bytes
64 bytes from 23.5.241.75: icmp_seq=0 ttl=55 time=19.7 ms
64 bytes from 23.5.241.75: icmp_seq=1 ttl=55 time=19.6 ms
64 bytes from 23.5.241.75: icmp_seq=2 ttl=55 time=19.6 ms
64 bytes from 23.5.241.75: icmp_seq=3 ttl=55 time=19.6 ms
64 bytes from 23.5.241.75: icmp_seq=4 ttl=55 time=19.6 ms

--- fast.com ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 19.6/19.6/19.7 ms

fg40f-utm (root) # exe traceroute fast.com
traceroute to fast.com (23.5.241.75), 32 hops max, 3 probe packets per hop, 84 byte packets
1 63.231.10.70 <tukw-dsl-gw70.tukw.qwest.net> 1.366 ms 1.881 ms 1.909 ms
2 63.226.198.41 <63-226-198-41.tukw.qwest.net> 2.014 ms 1.898 ms 1.900 ms
3 * * *
4 4.69.219.65 <ae2.3605.edge9.sanjose1.level3.net> 18.981 ms * *
5 4.14.32.70 <citigroup-i.bar2.sanfrancisco1.level3.net> 200.976 ms 124.634 ms 203.926 ms
6 * * *
7 * * *
8 23.5.241.75 <fast.com> 19.540 ms 19.830 ms 19.459 ms

Toshi

[AEK · Accepted solution]

In step 4 (firewall policy), destination should be All.

Then go to SD-WAN rules, and add the following rule:

• source: all
• destination: site1.com, site2.com
• strategy: manual
• interface preference: port4

Then add another SD-WAN rule "below" of the previous one:

• source: all
• destination: all
• strategy: manual
• interface preference: WAN

That will make things exactly in the way you requested.

[ATOON]

I tried DNS provided by the service provider, Google Public DNS, and OpenDNS but the same issue can't resolve the wildcard.

You can suggest DNS to try it?

[AEK]

Using Google DNS or OpenDNS is fine. If you want wildcard to work you need to disable DNS over SSL/HTTPS in your browser.

[ATOON · Accepted solution]

I found two cloud servers not running. All servers are now working fine.