Setting up a VIP load-balance with HTTP-host check in HTTP header with one WAN IP

[luky]

I followed the tech tip from: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-up-a-VIP-load-balance-with-HTTP-ho...

Now I have the question about the following situation:
I have one wan ip adress and the situation that i want different IPS/WAF profiles to the different http-hosts.

Is it possible and how? I tried creating a new virtual server with the same pub ip and other real hosts with different http headers but it didnt work. If i had fw rule 1 "wan-2-owncloud" where i had applied VServer-Owncloud with real ip 192.168.1.1 and port 443 and a 2nd fw rule "wan-2-wordpress" with realip 192.168.1.2 and port 443 then either owncloud was unreachable or wordpress was unreachable. What do I do if i want to apply IPS+WAF+FullDPI to wordpress and to owncloud just IPS+FullDPI?

[enguyen3467]

Hello,

If you want to apply different UTM profile for each internal hosts that will be translated from the same public IP, I would suggest doing static VIP with port forwarding: for example:
- For the VIP mapping the public IP to 192.168.1.1:443 --> we can do a VIP with external port mapping to be 4431 for example

- For the VIP mapping the public IP to 192.168.1.2:443 --> we can do a VIP with external port mapping to be 4432 

After doing so, you can create 2 firewall policies with the destination set to the VIP object with the desired UTM profiles. You can refer to this article for more info on how to configure VIP with port forwarding: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati...

Regards,

Erikson Nguyen 

[enguyen3467]

For virtual server, I don't think it will be possible. You can think of the virtual server as a VIP that can do mapping from one external IP to multiple real IP with the same port forwarding. It is one object, therefore, you can only apply one firewall policy refer to it