Source address filtering problem

[ujemvi]

Hello! I' m having trouble with a firewall policy. Here' s my config:

config firewall vip
     edit " 100.100.100.100" 
         set extip 100.100.100.100
         set extintf " wan1" 
         set mappedip 10.1.250.135
     next
 end
 
 config firewall address
 	edit " Crossfone-1-ALT" 
         set subnet 66.66.66.64 255.255.255.240
     next
 end
 	
 config firewall policy
 	edit 103
         set srcintf " wan1" 
         set dstintf " port1" 
         set srcaddr " Crossfone-1-ALT" 
         set dstaddr " 100.100.100.100" 
         set action accept
         set schedule " always" 
         set service " SIP"  " RTP"  " PING" 
         set logtraffic all
     next
 end
 	

Now, let me show you my session log for policy 103.

date=2013-11-11 time=18:56:06 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=31745 srcintf=" wan1"  dstip=100.100.100.100 dstport=11587 dstintf=" port1"  sessionid=438019366 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=11587 service=SIP proto=17 duration=185 sentbyte=288 rcvdbyte=92 sentpkt=2 rcvdpkt=1
 date=2013-11-11 time=18:55:41 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=27215 srcintf=" wan1"  dstip=100.100.100.100 dstport=16159 dstintf=" port1"  sessionid=438019366 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=16159 service=SIP proto=17 duration=190 sentbyte=288 rcvdbyte=184 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:55:24 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=35090 srcintf=" wan1"  dstip=100.100.100.100 dstport=15852 dstintf=" port1"  sessionid=438019366 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=15852 service=SIP proto=17 duration=121 sentbyte=120 rcvdbyte=120 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:55:02 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=31744 srcintf=" wan1"  dstip=100.100.100.100 dstport=11586 dstintf=" port1"  sessionid=438019366 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=11586 service=SIP proto=17 duration=121 sentbyte=120 rcvdbyte=120 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:54:32 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=27214 srcintf=" wan1"  dstip=100.100.100.100 dstport=16158 dstintf=" port1"  sessionid=438019366 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=16158 service=SIP proto=17 duration=121 sentbyte=120 rcvdbyte=120 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:52:56 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=204.101.27.220 srcport=5067 srcintf=" wan1"  dstip=100.100.100.100 dstport=5060 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Canada"  trandisp=dnat tranip=10.1.250.135 tranport=5060 service=SIP proto=17 duration=351 sentbyte=429 rcvdbyte=0 sentpkt=1 rcvdpkt=0
 date=2013-11-11 time=18:52:02 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.68 srcport=5060 srcintf=" wan1"  dstip=100.100.100.100 dstport=5060 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=5060 service=SIP proto=17 duration=298 sentbyte=10634 rcvdbyte=12038 sentpkt=16 rcvdpkt=19
 date=2013-11-11 time=18:52:02 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=40263 srcintf=" wan1"  dstip=100.100.100.100 dstport=17903 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=17903 service=SIP proto=17 duration=185 sentbyte=288 rcvdbyte=184 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:52:02 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=47735 srcintf=" wan1"  dstip=100.100.100.100 dstport=11287 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=11287 service=SIP proto=17 duration=142 sentbyte=288 rcvdbyte=184 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:52:02 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=54846 srcintf=" wan1"  dstip=100.100.100.100 dstport=13520 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=13520 service=SIP proto=17 duration=99 sentbyte=120 rcvdbyte=120 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:52:02 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=54847 srcintf=" wan1"  dstip=100.100.100.100 dstport=13521 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=13521 service=SIP proto=17 duration=99 sentbyte=288 rcvdbyte=184 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:51:41 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=47734 srcintf=" wan1"  dstip=100.100.100.100 dstport=11286 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=11286 service=SIP proto=17 duration=121 sentbyte=120 rcvdbyte=120 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:50:58 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=40262 srcintf=" wan1"  dstip=100.100.100.100 dstport=17902 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=17902 service=SIP proto=17 duration=120 sentbyte=120 rcvdbyte=120 sentpkt=2 rcvdpkt=2
 date=2013-11-11 time=18:50:15 logid=0000000013 type=traffic subtype=forward level=notice vd=root srcip=66.66.66.75 srcport=23465 srcintf=" wan1"  dstip=100.100.100.100 dstport=12549 dstintf=" port1"  sessionid=437952500 status=accept policyid=103 dstcountry=" Argentina"  srccountry=" Argentina"  trandisp=dnat tranip=10.1.250.135 tranport=12549 service=SIP proto=17 duration=190 sentbyte=288 rcvdbyte=184 sentpkt=2 rcvdpkt=2

So, the red line in the log. Why? Please help me to understand why is that traffic passing my policy.

[emnoc]

Interesting, can you do a show firewall policy 103 and validate the SRC that' s allowed? Also I notice the following from your log; duration=351 sentbyte=429 rcvdbyte=0 sentpkt=1 rcvdpkt=0 so are packets really getting to the server ?

[ujemvi]

so are packets really getting to the server ?

Yes. The server has a firewall, that' s why only 1 packet it' s getting pass through my FortiGate. But if I make a tcpdump on my server' s interface, I can see traffic that shouldn' t be getting there.

If you want to make your server at 10.1.250.135 accessible via the public IP 100.100.100.100 then you' ve got the policy wrong. You use the public address as the destination. In order for DNAT to work you have to put the VIP here, as destination address.

The DNAT is working. My VIP' s name is the same as the IP, " 100.100.100.100" , thus, the confusion.

[ede_pfau]

If you want to make your server at 10.1.250.135 accessible via the public IP 100.100.100.100 then you' ve got the policy wrong. You use the public address as the destination. In order for DNAT to work you have to put the VIP here, as destination address.

[emnoc]

config firewall vip

remove the 100.100.100.100 from your dst_address and install the named VIP and retest. config firewall policy edit 103 set srcintf " wan1" set dstintf " port1" set srcaddr " Crossfone-1-ALT" set dstaddr vip set action accept set schedule " always" set service " SIP" " RTP" " PING" set logtraffic all next end

[ujemvi]

Hi, The CLI doesn' t let me put in the dstaddr field anything else than a previously defined IP. It can be an address object or an VIP object. And the only object named ' 100.100.100.100' that I have it' s the VIP. So yes, I' m using the VIP in my policy. I really thank you for your help, but I don' t see how this is related with a failure in the source address filtering mechanism. Am I missing something?