Virtual Server not working on FortiWifi 51E 5.4

[FredMB]

Hi,

We are actually testing Fortinet to replace our router and I can't make the Virtual Server working.

I have two interfaces : a WAN interface (wan1) and a Lan interface (internal).

If I create a Virtual IP (not Virtual Server) from WAN to LAN, it works fine, I can access my internal server from outside.

But when I want to use a Virtual Server (configured through the web interface), nothing happens : I have no error message, I can't access my server from outside, and there is nothing in Monitor / Load Balance Monitor.

I used, as specified, a different IP on the wan interface than the one configured as primary wan ip. This IP is correctly routed because it works fine with a Virtual IP.

Here is my configuration : 

config firewall vip
edit "vs-http"
 set uuid 52b2575e-00c1-51e6-44ca-70e4e2d77d83
 set type server-load-balance
 set extip 37.xxx.xxx.222
 set extintf "wan1"
 set server-type http
 set monitor "vs-ping"
 set ldb-method round-robin
 set extport 8082
 config realservers
 edit 1
 set ip 192.168.200.3
 set port 80
 next
 end
 next
end

And here is the associated policy : 

config firewall policy
edit 4

set name "vs-http"

 set uuid 810e4f8e-00be-51e6-1949-2249a6106602
 set srcintf "wan1"
 set dstintf "internal"
 set srcaddr "all"
 set dstaddr "vs-http"
 set action accept
 set schedule "always"
 set service "HTTP"
 set logtraffic all
 set nat enable
 set fixedport enable
 next

end

Also, I can't select HTTPS for Server Type as it doesn't appear in the list. I don't know if both problems are linked or not.

Do you have any idea on how to solve this problem ?

Thank you for your help,

Fred

[ede_pfau]

hi,

and welcome to the forums.

In your policy, why do you set "fixedport enable"? This will prevent more than one session across this policy which is probably not what you intend.

Additionally, I would not enable NAT - this will make your server "blind" to where the requests are coming from. This "NAT" setting will do source address NAT, replacing the original source IP with the interface's IP. Of course, the server then needs a default route pointing back to the FGT.

[FredMB]

Hi,

Thank you for your reply.

The fixedport option was set during one of my trials to make virtual servers to work. Even when it's off, the virtual server is not listed in the monitoring page.

For the NAT option, it is explicitly specified in the documentation to turn it on (http://docs.fortinet.com/uploaded/files/2770/fortigate-load-balancing-54.pdf).

What I don't understand is why my Virtual Server doesn't appear in th emonitoring page. Even with routing problems it should be visible, no ?

Fred

[Carl_Wallmark]

Hi,

One thing I can see is that you have specified external port 8082, but the firewall policy only allow HTTP (port 80).

Create a service with 8082 and apply that to your firewall policy.

[JohnAgora]

What about doing a debug flow.

diagnose debug enable

diagnose debug flow filter add <requester_IP>

diagnose debug flow trace start 30

If you can't see the error, share the debug here.

[FredMB]

No matter which service I set in the policy (ALL, HTTP80, HTTP on 8082), the virtual server is not visible in Monitor and thus not working.

Here is the debug I got with a filter on the external IP: 

id=20085 trace_id=72 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57338->37.xxx.xxx.222:8082) from wan1. flag , seq 105559004, ack 0, win 8192"
id=20085 trace_id=72 func=init_ip_session_common line=4868 msg="allocate a new session-00682c07"
id=20085 trace_id=73 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57337->37.xxx.xxx.222:8082) from wan1. flag , seq 2676794451, ack 0, win 8192"
id=20085 trace_id=73 func=init_ip_session_common line=4868 msg="allocate a new session-00682c08"
id=20085 trace_id=74 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57339->37.xxx.xxx.222:8082) from wan1. flag , seq 2446153442, ack 0, win 8192"
id=20085 trace_id=74 func=init_ip_session_common line=4868 msg="allocate a new session-00682c12"
id=20085 trace_id=75 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57338->37.xxx.xxx.222:8082) from wan1. flag , seq 105559004, ack 0, win 8192"
id=20085 trace_id=75 func=init_ip_session_common line=4868 msg="allocate a new session-00682c37"
id=20085 trace_id=76 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57337->37.xxx.xxx.222:8082) from wan1. flag , seq 2676794451, ack 0, win 8192"
id=20085 trace_id=76 func=init_ip_session_common line=4868 msg="allocate a new session-00682c38"
id=20085 trace_id=77 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57339->37.xxx.xxx.222:8082) from wan1. flag , seq 2446153442, ack 0, win 8192"
id=20085 trace_id=77 func=init_ip_session_common line=4868 msg="allocate a new session-00682c43"
id=20085 trace_id=78 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57337->37.xxx.xxx.222:8082) from wan1. flag , seq 2676794451, ack 0, win 8192"
id=20085 trace_id=78 func=init_ip_session_common line=4868 msg="allocate a new session-00682c98"
id=20085 trace_id=79 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57338->37.xxx.xxx.222:8082) from wan1. flag , seq 105559004, ack 0, win 8192"
id=20085 trace_id=79 func=init_ip_session_common line=4868 msg="allocate a new session-00682c99"
id=20085 trace_id=80 func=print_pkt_detail line=4717 msg="vd-root received a packet(proto=6, 80.yyy.yyy.84:57339->37.xxx.xxx.222:8082) from wan1. flag , seq 2446153442, ack 0, win 8192"

Fred