[SOLVED] Fortigate Port Forwarding to several internal hosts

[tsypyshev_pi]

Good day!

Does anybody use port forwarding from 1 external ip to several internal hosts?

For example, I have IP 1.1.1.1 on wan1 and want to translate port 21 to 192.168.1.2:21, port 25 to 192.168.1.3:25port 80 to 192.168.1.4:80.

First virtual IP was created without any problem. But when I try to add second VIP with my 1.1.1.1 external IP, I catch this error: "Conflicts with the External IP of another VIP". I've created only 2 VIPs on wan1 at all - first 1.1.1.1:21 -> 192.168.1.2:21 and second 0.0.0.0:25 -> 192.168.1.2:25. Third VIP I cannot create.

Another vendors, such as Cisco or Zyxel, can translate too much external ports to different local hosts and ports.

I'm guess, that Fortigate can do the same. But I haven't find any manual for this.

Only 1 external IP to 1 internal IP.

Thanks in advance for your help.

[Toshi_Esumi · Accepted solution]

How about his cookbook?

https://cookbook.fortinet.com/using-virtual-ips-configure-port-forwarding-54/

[tsypyshev_pi]

Hi Toshi! Thanks for your answer. I've read this article before. But every time I've stopped when I saw red highlighted text "Conflicts with the External IP of another VIP". Only today I've tried setup all external and internal IPs and when I've defined external port then this error message was disappeared. It's really discourage message. Thank you very much for help!

[Thompsons]

I've been running into this issue too. 

How did you get around it? It seems like a firmware update issue because if I edit some of the existing VIPs I receive this error but if I cancel out, they work fine.

Did you find a way to get around this issue?

[ede_pfau]

No doubt multiple VIPs do work from one external to several internal IPs, provided that each uses port translation and does not use a wildcard '0.0.0.0' for the external address.

Tip: after creating the VIPs you need, put them into a VIP group so that one policy will suffice.

[Thompsons]

I created a ticket with FGT support in the end and found it is an issue with the current firmware.  From CLI,  we could create the VIP without issue but the gui would always give the error "Conflicts with the External IP of another VIP"

We're on v6.2.0 build0866 (GA) and hear there is new firmware coming out very soon that will fix this issue.

The VIP's we have all have external IP of 0.0.0.0 but we have several different WAN interfaces that we associate them with.

[korwinau]

I've been trying to perform port forwarding myself for the past day or two however i'm working with a Dynamic IP on the WAN interface (everything I've read suggests leaving the extIp as 0.0.0.0).  I ran into this exact same problem however mine came from specifying mutliple VIPs in which a port is used for both TCP and UDP.  I found that the "duplicate" could be added when using the CLI which would suggest a GUI bug.

Try using the bellow (obviously name it whatever you need to and set the extintf to the correct name for your setup).

config firewall vip edit "Second 1.1.1.1 VIP" set extip 1.1.1.1 set extintf "wan interface" set portforward enable set mappedip 192.168.1.2 set extport 21 set mappedport 21 next end

[ede_pfau]

That's correct, you actually need to use '0.0.0.0' if the WAN IP is dynamic. Slipped on that one.

So, in the end, a GUI check routine prevents a totally valid config. This isn't the first time such a thing happens.

[orani]

I think you can't configure the port forward for port 80 because your fgt listens to port 80 for its web gui. If you change that port you will be able to do what you want