Hi,
We are actually testing Fortinet to replace our router and I can't make the Virtual Server working.
I have two interfaces : a WAN interface (wan1) and a Lan interface (internal).
If I create a Virtual IP (not Virtual Server) from WAN to LAN, it works fine, I can access my internal server from outside.
But when I want to use a Virtual Server (configured through the web interface), nothing happens : I have no error message, I can't access my server from outside, and there is nothing in Monitor / Load Balance Monitor.
I used, as specified, a different IP on the wan interface than the one configured as primary wan ip. This IP is correctly routed because it works fine with a Virtual IP.
Here is my configuration :
config firewall vip
edit "vs-http"
set uuid 52b2575e-00c1-51e6-44ca-70e4e2d77d83
set type server-load-balance
set extip 37.xxx.xxx.222
set extintf "wan1"
set server-type http
set monitor "vs-ping"
set ldb-method round-robin
set extport 8082
config realservers
edit 1
set ip 192.168.200.3
set port 80
next
end
next
end
And here is the associated policy :
config firewall policy
edit 4
set name "vs-http"
set uuid 810e4f8e-00be-51e6-1949-2249a6106602
set srcintf "wan1"
set dstintf "internal"
set srcaddr "all"
set dstaddr "vs-http"
set action accept
set schedule "always"
set service "HTTP"
set logtraffic all
set nat enable
set fixedport enable
next
end
Also, I can't select HTTPS for Server Type as it doesn't appear in the list. I don't know if both problems are linked or not.
Do you have any idea on how to solve this problem ?
Thank you for your help,
Fred
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
hi,
and welcome to the forums.
In your policy, why do you set "fixedport enable"? This will prevent more than one session across this policy which is probably not what you intend.
Additionally, I would not enable NAT - this will make your server "blind" to where the requests are coming from. This "NAT" setting will do source address NAT, replacing the original source IP with the interface's IP. Of course, the server then needs a default route pointing back to the FGT.
Hi,
Thank you for your reply.
The fixedport option was set during one of my trials to make virtual servers to work. Even when it's off, the virtual server is not listed in the monitoring page.
For the NAT option, it is explicitly specified in the documentation to turn it on (http://docs.fortinet.com/uploaded/files/2770/fortigate-load-balancing-54.pdf).
What I don't understand is why my Virtual Server doesn't appear in th emonitoring page. Even with routing problems it should be visible, no ?
Fred
Hi,
One thing I can see is that you have specified external port 8082, but the firewall policy only allow HTTP (port 80).
Create a service with 8082 and apply that to your firewall policy.
FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C
What about doing a debug flow.
diagnose debug enable
diagnose debug flow filter add <requester_IP>
diagnose debug flow trace start 30
If you can't see the error, share the debug here.
No matter which service I set in the policy (ALL, HTTP80, HTTP on 8082), the virtual server is not visible in Monitor and thus not working.
Here is the debug I got with a filter on the external IP:
id=20085 trace_id=72 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57338->37.xxx.xxx.222:8082) from wan1. flag, seq 105559004, ack 0, win 8192"
id=20085 trace_id=72 func=init_ip_session_common line=4868 msg="allocate a new session-00682c07"
id=20085 trace_id=73 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57337->37.xxx.xxx.222:8082) from wan1. flag, seq 2676794451, ack 0, win 8192"
id=20085 trace_id=73 func=init_ip_session_common line=4868 msg="allocate a new session-00682c08"
id=20085 trace_id=74 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57339->37.xxx.xxx.222:8082) from wan1. flag, seq 2446153442, ack 0, win 8192"
id=20085 trace_id=74 func=init_ip_session_common line=4868 msg="allocate a new session-00682c12"
id=20085 trace_id=75 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57338->37.xxx.xxx.222:8082) from wan1. flag, seq 105559004, ack 0, win 8192"
id=20085 trace_id=75 func=init_ip_session_common line=4868 msg="allocate a new session-00682c37"
id=20085 trace_id=76 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57337->37.xxx.xxx.222:8082) from wan1. flag, seq 2676794451, ack 0, win 8192"
id=20085 trace_id=76 func=init_ip_session_common line=4868 msg="allocate a new session-00682c38"
id=20085 trace_id=77 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57339->37.xxx.xxx.222:8082) from wan1. flag, seq 2446153442, ack 0, win 8192"
id=20085 trace_id=77 func=init_ip_session_common line=4868 msg="allocate a new session-00682c43"
id=20085 trace_id=78 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57337->37.xxx.xxx.222:8082) from wan1. flag, seq 2676794451, ack 0, win 8192"
id=20085 trace_id=78 func=init_ip_session_common line=4868 msg="allocate a new session-00682c98"
id=20085 trace_id=79 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57338->37.xxx.xxx.222:8082) from wan1. flag, seq 105559004, ack 0, win 8192"
id=20085 trace_id=79 func=init_ip_session_common line=4868 msg="allocate a new session-00682c99"
id=20085 trace_id=80 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57339->37.xxx.xxx.222:8082) from wan1. flag, seq 2446153442, ack 0, win 8192"
Fred
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1692 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.