my issue is the following.
The customer is migrating to new DNS servers on DMZ, but they have too many endpoints on the LAN with old DNS servers (x.x.x.x) configured, they want to MAP the ip for the old DNS servers (x.x.x.x) to the new DNS servers (y.y.y.y)
This can be acomplished using DNAT with the following configuration
VIP:
set service "DNS"
set extip x.x.x.x
set mappedip y.y.y.y
set extintf LAN
after doing this, the DNS traffic going the old DNS servers is natted correctly, but the server x.x.x.x is still giving another services and after natting DNS traffic, Fortigate treats x.x.x.x as virtual IP and any other traffic going to x.x.x.x is dropped with the error "iprope_in_check() check failed on policy 0, drop"
is there a way to do this nat and still have another services on x.x.x.x without considering x.x.x.x as Virtual IP?
after doing this,
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Did you try to use portforward instead of "set service DNS"?
set portforward enable
set protocol udp
set extport 53
set mappedport 53
However I'm not sure if this will actually work because once you configure a VIP then from FG prospective it's like if the whole IP is now owned by FG (as per my understanding), so if you have two equipment on your network with the same IP its simply IP conflict (malfunction and bad design).
In case it doesn't work I think is better not using such workaround and use clean configuration instead.
For example you may change DHCP config to assign the new DNS server to your DHCP clients instead of the old one, and for hosts with static IP config you may take the required time to migrate them one by one.
Hi,
Please follow the below article which might help to configure port forwarding only for DNS traffic
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-Virtual-IPs-to-configure-port-forwar...
Hello @Jose-Perez_Netics ,
I believe from your description that other traffic going to end device is not reaching there.
In addition to above suggestions, please try to disable 'arp-reply' in VIP:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-ARP-reply-setting-in-Virtual-IP-IP-Pool/ta...
If you create a VIP object with an IP which also belongs to an end device then fortigate would treat the IP as local IP if this setting is enabled.
Regards,
Varun
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1633 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.