Routing for FTP Server

[#1]

Hi, I have FTP Server in my Organisation, I need FTP server to have Public IP as my vendors will directly FTP to the server and dump the files, also i need local LAN team to access that files, I have Router ethernet connecting to fortigate firewall 800 external interface and Internal Interface connecting to inside network Kindly let me know how do i achieve the same Thanks....Kiran

[rwpatterson]

NAT only needs to be used on outgoing traffic. On the VIP definition, disable port forwarding so that all ports are sent to the server. Run your tests and when you are sure it is working as planned, narrow down the acceptable protocols.

[#3]

No, its not working. I am able to ping from the fortigate firewall to the external IP add, but if i try to telnet or ping from outside it doesnot ping, its requst timedout i tried all in policy allowing all services and only FTP and PING,ICMP, but still i am unable to ping from the outside network, if I telnet from Fortigate firewall to the FTP server IP address i get a telnet access to the firewall again, help me, Scenario: outside people wants to access FTP server in the DMZ zone Server, VIP is configured on Fortigate firewall and mapped to internal DMZ server IP addr, policy is external to internal all services all time allowed

[abelio]

Could you post your FTP firewall policies please? The ouput of this CLI commands: show full-configruation firewall policy <id> where <id> is the ID-number of your firewall policies you' de defined for your FTP traffic. Obfuscate your actual IP numbers if you consider it important.

[#5]

please find the Output file shows the output file of show firewall vip and show full-config firewall policy ID config firewall policy edit 1 set srcintf " external" set dstintf " internal" set srcaddr " all" set dstaddr " FTP-Server" set action accept set status enable set schedule " always" set service " ANY" set profile-status disable set logtraffic enable set trafficshaping disable set ntlm disable set fsae disable set disclaimer disable set fsae-guest-profile ' ' set natip 0.0.0.0 0.0.0.0 set diffserv-forward disable set diffserv-reverse disable set tcp-mss-sender 0 set tcp-mss-receiver 0 set comments ' ' set label ' ' set auth-cert ' ' set nat disable next end FTP SERVER is show firewall VIP edit " FTP-Server" set extip 202.180.180.180 set extintf " external" set mappedip 192.168.25.21 next end

[UkWizard]

This is probably a ftp server config issue, as if you have two NICs it gets messy for routing. Not quite sure why you need two, you say one is " outside" . what do you mean? it cannot be an public address if its behind the fortinet, unless you are using the fortinet in a unsual manner. if you have two nics, you could suffer from default gateway routing issues. make sure you only have one default route ip set on it, and that should be the fortinet. else it wont work. If you could elaborate on the ftp nic setup, i am sure we will all go " aha thats why" ....

[#7]

I have a default IP gateway as my Fortigate IP address on the FTP server, but still i facing a prob, I use 2NIC becaz, fortigate internal interface is connecting to switch, Server One NIC is connected to that switch and another NIC is connected to internal switch, now the problem is from outside am not able to ping or connect to my FTP server,

[UkWizard]

so let me get this right, your internal port on the firewall, doesnt actually go into your lan? it goes into a switch, which then only connects to one port on the ftp servers? and the other nic on the ftp server goes to the lan? is that correct? why is it like this?, sounds like a very odd setup to me. Anyway, presuming i got it right above, i am guessing the IP subnets on the two NICs on the ftp server are definatelty in totally different IP ranges?? and that ONLY the nic facing the firewall has the default route set? You must not be using two IPs on the ftp' s NICs that overlap or are on the same subnet range. and also only one default should exist on the ftp server. can you confirm the ip ranges that are on the two NICs?

[#9]

Thanks for reply, basically FTP is in the DMZ area, so it needs 2 NIC' s, both are in differnt network' s, means one NIC having 192.168.1.x, other having the 172.20.9.x, and i have assigned One NIC (192.168.1.x) to fortigate IP as gateway, other doesnot have gateway, Fortigate is also having 192.168.1.x IP address to the internal interface, please let me know for further clarifications,

[#10]

My Policy Rule is Source- external interface, source address-all destination-internal interface, destination is FTP-Server (VIP address) always an all services accept any time, i had changed it to FTP service aswell but no luck,

[UkWizard]

so the ftp server has one nic connected to the DMZ and one connected to the internal network? if so, this is very wrong. YOU SHOULD NOT HAVE THIS !! the whole idea of placing web-facing servers in the DMZ is so that if they get hacked, they then cannot use that server to attack internal machines, and thus internal data. The FTP server should only be connected to the DMZ, and the fortinet does the routing for any internal hosts wanting to access the FTP server, via the fortinet. ie; Internal Lan | | Fortinet ------------ DMZ (FTP/Web servers etc) | | Internet via ISP if a server is placed between the DMZ AND the Lan, it is absolutley pointless it being in the DMZ in the first place, as if it got hacked, they would still have access to the internal network. so either move it within the lan (not recommended though) or only have it connected to the DMZ.