Virtual IP and External FW IP address

[#1]

I' m looking a solution for the following scenario: Let' s said that a small company with a internet cable connection wants to host their own mail and web server, the ISP assigns the fixed static IP address 12.220.5.5, so using fortinet 50a you have the following config: fw ext ip address: 12.220.5.5 fw int ip address: 192.168.1.1 mail server : 192.168.1.10 web server: 192.168.1.11 Based on the user guide (see below) you can NOT create a Virtual IP association like Ext interface: external Ext IP: 12.220.5.5 (same fw ext IP) Ext port: 80 type: port forwarding Int IP: 192.168.1.11 Int Port: 11 To me it is hard to believe that I can' t do something like this, you have to have at least to public IP addresess ? If you buy a Linksys router this is a quite simple task, any help would be appreciated user guide referal: For example, if the virtual IP provides access from the Internet to a web server on a destination network, the external IP address must be a static IP address obtained from your ISP for your web server. This address must be a unique address that is not used by another host and cannot be the same as the IP address of the external interface selected in step 4. However, the external IP address must be routed to the selected interface..

[UkWizard]

You can do this, but use port-forwarding in the two vips and put " 0.0.0.0" for the external addresses. This tells it to use any external addresses. Eg; Mail-VIP ExtIP: 0.0.0.0 Port: 25 IntIP: 192.168.1.10 Port: 25 Web-VIP ExtIP: 0.0.0.0 Port: 80 IntIP: 192.168.1.11 Port: 80 This should work fine.

[#3]

Hi UKWizard, How do i translate from one port to another port ? Lets say if i configure as below in FGT will it work ? Web-VIP ExtIP: 1.1.1.1(ext ip of FGT) Port: 443 IntIP: 192.168.1.11 Port: 80 I have configured like this , but still it doesnot work ? I need my customers to use https for accessing and then FGT should redirect to port 80 internally. I have 2 firewall rules :- Int -> Ext -> All -> Allow -> Nat enabled Ext -> VIP -> All -> Allow -> Nat Disabled FGT firmware version is 2.80 MR6 Please help me.

[UkWizard]

That would not work, as port 443 is the https, therefore the web browser would try to setup an ecnryption to the web server. Try accessing the url differently, like so; http://yourwebserver.com:443 This should force the web browser to use http unencrypted. But whats the point ? why point to a secure port, if it isnt secure. You need to setup https on the webserver and go straight through for 443. NOTE: First off, you would need the external port https remote gui access DISABLED.

[#5]

Hi UkWizard, http://serverip:443 works fine. No issues on that. But what i am looking at it is that since 443 is for https and since the above URL works , why not https://serverip basically this request hits Fortigate and since i have a Port translation configured on fortigate , it translates from 443 to 80 and the request gets passed onto the web server.

[UkWizard]

as i explained above, https means its encrypted !!! So if you use https:// at the beginning, the first thing the browser does is to try to make an encrypted tunnel to the webserver. Which obviously fails, because the webserver would not accept the encryption request on port 80. To be able to use https:// you would need to configure your webserver to allow https connections, then port forward that 443 port as well. This would come up with an invalid certificate, which would need a ' yes' answer to a box in the browser. Unless you use a proper SSL certificate

[#7]

Redhat, you have a bit of a misunderstanding. You seem to be trying to get secure (encrypted) traffic from the internet to the firewall, then normal http traffic from the firewall to the webserver. You cannot do this with fortinet. It is not an https proxy and cannot work that way. If you need https, you must set your webserver up to use https, then forward port 443 to it. Otherwise you should stick to port 80. As it is now it will connect fine, but the webserver will only see garbage encrypted traffic coming in to it and drop the connection. Using the http://ip:443 syntax is telling it to use normal unencrypted traffic on a different port, which is why it works.