VIP Issue

[Gerry]

Hi (edit: 4.0 MR3 on a 200b) I' m setting up a VIP for an internal server to allow it server http traffic. We already have another server doing the same and it' s working fine. I cannot get the new server to work. I' ve created the same rules, placed them side by side in order beside the working rule but it will not work. Once the policy rule for the WAN - WebServer is enabled it even breaks outgoing traffic for the webserver. If I disable the WAN - WebServer policy the outgoing traffic works again. I can get no WAN - WebServer traffic working. We have a range of 4 public IPs so the one I' m using for the WebServer is dedicated. I did a show for the config and the rules for the new Webserver and the existing working Webserver are the same (minus the slight IP address differences) Any ideas where I can look? Some of the config is below:

 config firewall vip
     edit " WorkingServer" 
         set extip ##.###.##.#2
         set extintf " port12" 
         set mappedip ###.##.##.100
     next
     edit " NewServer" 
         set extip ##.###.##.#3
         set extintf " port12" 
         set mappedip ###.##.##.160
     next
 end
 
 
 config firewall policy
 edit ##
     set srcintf " WAN" 
     set dstintf " LAN" 
         set srcaddr " all"              
 		set dstaddr " WorkingServer"              
     set action accept
     set schedule " always" 
         set service " HTTP"  " HTTPS"             
     set logtraffic enable
 next
 edit ##
     set srcintf " WAN" 
     set dstintf " LAN" 
         set srcaddr " all"              
         set dstaddr " NewServer"              
     set action accept
     set schedule " always" 
         set service " HTTP"  " HTTPS"             
     set logtraffic enable
 next
 

Many thanks gR

[rwpatterson]

Additionally, you could run a sniffer test on the FGT to see if the traffic is arriving there.

 FGT # diagnose sniffer packet <WAN_port> ' host <outside_IP_address>' 

When running a PING, you should see the packets going out, then coming back in.

[ede_pfau]

cough...that was already suggested some time ago...you' d instantly SEE what is going on.

[rwpatterson]

Hey it' s busy here. I haven' t kept up with all the posts... Sue me. :) (you won' t get much!)

[ede_pfau]

Totally. I' m already after hours. Maybe Gerry finds time to sniff this.

[Gerry]

After much chasing our ISP have come back to say there is a route config error in their systems in relation to our IP assignment! They plan to sort it tomorrow morning so all going well that' s the problem. Thanks for the help, apologies for any wasted time. Rgds gR

[rwpatterson]

Plus one for Bob!