Virtual IP with port forwarding

[abood]

Hello,

I have a strange issue regarding the Virtual IP with port forwarding:

i have fortios: 5.4

Type: Static NAT

External IP Address/Range: x.x.x.x - x.x.x.x

Mapped IP Address/Range: 192.168.100.15 - 192.168.100.15

port forwarding:

Protocol: TCP

External Service Port: 25- 25

Map to Port: 25 - 25

And i configured the policy as required:

Source: any

destination: VirtualIP_name

service: smtp

now, when i try to test from any public PC to telnet x.x.x.x 25 it is failed.

the strange issue is that when i changed the External Service Port: 25- 25 to

External Service Port: 255- 255

and test from the public PC to telnet x.x.x.x 255 it is success and i can see the the server SMTP output?!!!

any help or suggestions?

[ede_pfau]

hi,

and welcome to the forums.

I would think that some other policy higher up in sequence is catching the SMTP traffic.

You stated the policy settings but did not mention the interfaces involved. Hopefully, you do not use the 'any' interface but the specific interface for LAN (e.g. 'internal') and WAN (e.g. 'wan1'). Both in the policy and the VIP definition. Debugging 'any' interface objects can be very hard.

[abood]

Hello and thank you for your help.

the problem is solved, i was trying to telnet x.x.x.x 25 from two of my local ISPs and they blocked this port, so, i tried to use online telnet tool from the internet to x.x.x.x 25 and is succeeded.

I have another question if you please: is there any limitation if we have use and enable the virtual IP through WAN1 (ISP1) and activate the WAN link load balancing

Many thanks for your help

[ede_pfau]

I don't think so but...I seldomly use WLLB. My impression is that the WLLB is a kind of wrap around ECMP, together with grouping the WAN interfaces into a zone. To my dismay, you cannot use all features of an interface for a zone; if you can use all features of an interface with WLLB virtual interface, I'm not sure.

Luckily, you can test that easily. Set up a WLLB (even on 2 unused ports) and try to define a VIP on the virtual port. It would be nice if you test this to post back your findings.

[MikePruett]

abood wrote:

Hello and thank you for your help.

the problem is solved, i was trying to telnet x.x.x.x 25 from two of my local ISPs and they blocked this port, so, i tried to use online telnet tool from the internet to x.x.x.x 25 and is succeeded.

I have another question if you please: is there any limitation if we have use and enable the virtual IP through WAN1 (ISP1) and activate the WAN link load balancing

Many thanks for your help

I personally have not experienced that issue while doing WLLB. I am running 5.4 as well on my personal FortiGate 92D. I load balance multiple connections and use dynamic DNS to enable me to have external access from the same IP. Never had an issue. *knocks on wood*

[abood]

Hello all,

I have tested the Virtual IP with WLB and everything works fine as expected.

thank you all.