Webaccess port 80 not working

[#1]

Moving from a SnapGear to Fortinet 80c Mostly working on my test but for WebAccess to Email. Created a VIP with port 80 forwarded to internal webserver port 80. Internally it runs the app that accesses GroupWise Webaccess. On the SnapGear simply had to forward port 80 to the internal server and it works. No such luck on the Fortinet device. Suggestions?

[rwpatterson]

Welcome to the forums. Did you also create a policy, and use the VIP as the destination? That step is required as well.

[#3]

Yes. I setup 2 VIP' s, each using a different port. One for remote access to our teminal server, the other for webaccess. Each VIP has an associated policy. Remote access works fine, but not webaccess using port 80. Unfortunately until I get this resolved I cannot go live with this router. So need to do my testing and configuring during closed office hours.

[rwpatterson]

Our Webaccess (GroupWise as well) uses HTTPS, port 443. Are you sure yours is not as well?

[#5]

Hmmm. Thanks Bob I never had to forward or deal with port 443 on our snapgear. Can you tell me how I should deal with this on fortinet? This is my first experience with Fortinet. My policy is from Wan to webaccess always, any service, accept. I have NAT unchecked as well as all other check boxes including protection profile. Suggestions greatly appreciated.

[rwpatterson]

In the VIP mapping, use the port 443 instead. That' s it. The policy is already sending everything to the server. You need to allow only 443 via the VIP mapping. From inside your firewall, you should be able to tell what port web access works on. Try both HTTP and HTTPS and see which one gets you a response.

[#7]

Thanks again. Internally http:/webaccessserver/servlet/webacc https gives me a not found error. I can reconfigure and try port 443 after 5 (PST) tonight. Will get back to this after that test.

[rwpatterson]

Make sure it responds on HTTPS before you waste more effort.

[#9]

It does not respond to https. GroupWise version 6.5 I am reviewing my documentation but cannot see any reference to https, rather all references are to http. To repeat it works with my snapgear forwarding port 80 only. Currently the users enter http://web_server_ip_address/servlet/webacc and it works. What is causing the fortigate to deny this port? Intrusion protection?

[#10]

I changed the admin http port already. The https port is still 443, but I do not think that is the problem. THis device recently purshased has firmware 3.0D I see from several other posts that firmware 4 is now stable and recommended. I will have to get that done as well. Maybe that will help. Thanks for the thoughts and help.