Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
danishm99
New Contributor

Unable to access virtual service from internal IP's

Hi Experts,

 

I have configured a virtual service on Fortigate in same IP range as of outside interface. Now I have a requirement to access the Virtual server IP from same subnet servers as of backend server on virtual server.

 

Is this possible, if so how can I achieve this.

 

I am aware of hairpin NAT in case of VIP but this is a different scenario where I want to access virtual server IP. Please help

2 REPLIES 2
AEK
SuperUser
SuperUser

Suppose that internal subnet is 10.0.0.0/24, back-end server is 10.0.0.1 and VIP is 172.16.0.1.

I think the hosts from same subnet as back-end server will fall in some L3 related issue:

- Some host 10.0.0.2 tries to reach 172.16.0.1

- Packet reaches 10.0.0.1 through the VIP

- 10.0.0.1 replies to 10.0.0.2

- since it is on the same subnet, 10.0.0.2 receives reply directly from 10.0.0.1, not from 172.16.0.1

- Result : 10.0.0.2 drops the packet since it is unsolicited connection

 

So I thinks the only way for hosts from 10.0.0.0/24 to access 10.0.0.1 is to not use the VIP.

 

AEK
AEK
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors