Request for Site Access via Specific Port

[ATOON]

Hi,

Assistance with a network configuration. We have two internet modems in our current setup:

1. A fiber connection linked to the Forti WAN port.
2. A DIA with a static IP connected to Forti port number 4.

The internet is functioning correctly from the WAN port, now we need the user login to specified sites accessed exclusively through port number 4.

Modem: FortiWiFi 30E

Firmware: v6.2.15 build1378 (GA)

[Toshi_Esumi · Accepted solution]

So far looks fine. Can you ping "fast.com"? Since I can ping it from my 40F, you should be able to. If not, try traceroute.

fg40f-utm (root) # exe ping fast.com
PING fast.com (23.5.241.75): 56 data bytes
64 bytes from 23.5.241.75: icmp_seq=0 ttl=55 time=19.7 ms
64 bytes from 23.5.241.75: icmp_seq=1 ttl=55 time=19.6 ms
64 bytes from 23.5.241.75: icmp_seq=2 ttl=55 time=19.6 ms
64 bytes from 23.5.241.75: icmp_seq=3 ttl=55 time=19.6 ms
64 bytes from 23.5.241.75: icmp_seq=4 ttl=55 time=19.6 ms

--- fast.com ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 19.6/19.6/19.7 ms

fg40f-utm (root) # exe traceroute fast.com
traceroute to fast.com (23.5.241.75), 32 hops max, 3 probe packets per hop, 84 byte packets
1 63.231.10.70 <tukw-dsl-gw70.tukw.qwest.net> 1.366 ms 1.881 ms 1.909 ms
2 63.226.198.41 <63-226-198-41.tukw.qwest.net> 2.014 ms 1.898 ms 1.900 ms
3 * * *
4 4.69.219.65 <ae2.3605.edge9.sanjose1.level3.net> 18.981 ms * *
5 4.14.32.70 <citigroup-i.bar2.sanfrancisco1.level3.net> 200.976 ms 124.634 ms 203.926 ms
6 * * *
7 * * *
8 23.5.241.75 <fast.com> 19.540 ms 19.830 ms 19.459 ms

Toshi

[AEK · Accepted solution]

In step 4 (firewall policy), destination should be All.

Then go to SD-WAN rules, and add the following rule:

• source: all
• destination: site1.com, site2.com
• strategy: manual
• interface preference: port4

Then add another SD-WAN rule "below" of the previous one:

• source: all
• destination: all
• strategy: manual
• interface preference: WAN

That will make things exactly in the way you requested.

[ATOON]

I awaiting the arrival of a new device model and I'll try this configured on it

[AEK]

Hello

If I understand well you need to:

• Route access from internal user to siteA and siteB through port4
• Route all other internet access through WAN port

Right?

Then you can for example integrate port4 and WAN interfaces in SD-WAN and configure all the above rules in a very simple way.

You can start here:

https://docs.fortinet.com/document/fortigate/6.4.15/administration-guide/889544/sd-wan-quick-start

[ATOON]

Hi bro,

I followed the method you're mentioned in the above link, but I did not find in the method mentioned the way to add the sites that I wanted to open on port no# 4.

[AEK]

Hi Atoon

You specify the FQDN (site1.com, site2.com) in the Destination > Address field, and in the Interface Preference field you select port4.

[ATOON]

Used this method with static route without success.

[AEK]

There is only one static route for SD-WAN interface, its default route uses SD-WAN interface.

In SD-WAN the routes are SD-WAN rules (as described in my above post) which are policy routes, so you don't need to add an extra static route towards site1.com and site2.com.

[ATOON]

Regarding a method you've mentioned for accessing specific websites. I've implemented the approach, but unfortunately, I'm have an issue.
While the specific site is accessible and functioning as expected, I am unable to open other sites, such as Google or any sites.

1- Create a new address and add address needed.

2- Create SD-WAN ---> add WAN port and Port no# 4 as Interface Members

3- Create Static route as the below

4- Create Policy ---> Incoming Interface (Internal), Outgoing Interface (SD-WAN), Source Address (All), Destination (Address added in step 1) and enabled NAT

[AEK · Accepted solution]

In step 4 (firewall policy), destination should be All.

Then go to SD-WAN rules, and add the following rule:

• source: all
• destination: site1.com, site2.com
• strategy: manual
• interface preference: port4

Then add another SD-WAN rule "below" of the previous one:

• source: all
• destination: all
• strategy: manual
• interface preference: WAN

That will make things exactly in the way you requested.

[ATOON]

Yes, it's worked now.

Another issue when adding the address site1.com it's worked, but when added as wildcard *.site1.com not work

[AEK]

There are some conditions for wildcard FQDN to work properly.

• You have to use non encrypted DNS like DNS over TLS or DNS over HTTPS. So your clients have to use classic DNS
• The DNS query and DNS response must transit through FGT, it means client and DNS server must be on different segments and separated by FGT

If those conditions are not met then wildcard FQDN will not work properly, and you will need to enter in FGT each of the subdomains, like sub1.site1.com, sub2.site1.com, and so ...