Unable to reach virtual server on a VLAN

[roberto_papa]

Hi,

I've created virtual servers on Fortigate (eg: mail.customer.com, phone.customer.com...) and all works on LAN, but when i connect my pc to a VLAN i can't reach no one of them, so if (for example) i want to connect to my mail server it didn't works.

I'm able to ping mail.customer.com (return public IP).

I've created firewall policy rule but i'm not sure how to create static route and/or policy route.

Can you help me?

Thanks.

[adambomb1219]

Need way more details here.  Does DNS work?  Is there a policy in place?  Is this inbound NAT using a virtual IP?  Something else?

[roberto_papa]

I've reply with my configuration

[dingjerry_FTNT]

Hi @roberto_papa ,

Could you please attach the FGT config? 

Or at least share the VIP configurations and relevant firewall policies.

[roberto_papa]

I've reply with my configuration

[Sheikh]

Hello @roberto_papa 

With this limited information, it would be difficult to provide or suggest next action plans.

regards,

Sheikh

[roberto_papa]

If i ping a virtual server it return me public IP, not local IP (i don't want to forward traffic locally VLAN-LAN).
I've created virtual server for VLAN: 

and policy

I don't create DNS server for VLAN because i want ping virtual server by public IP, not local IP (if create DNS server for VLAN is the only possible solution, i create it).

Tracert goes out, but it stop on public IP when the packet return.

Maybe it's a static routes problem:

or policy route problem:

[dingjerry_FTNT]

1) I am not sure why you are not using VIP.  You are using Virtual Server unless you have multiple real servers for load balancing; otherwise, you may use VIP.  Apparently, you don't.

Please check this KB for how to configure VIP:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati...

2) The static route for the external IP of your Virtual Server is supposed to be linked to "VLAN Ospiti", not "lan".

[dingjerry_FTNT]

Oh, the policy route is not necessary.

[roberto_papa]

I have multiple virtual server that use same source port, so i can't use VIP but virtual server.