fortigate virtual ip cant access from outside

[Zenhusen]

I have replaced the current firewall an old 50E with a new 60F
Sadly we could not use the config file from the old one.

1. I have setup VirtualsIP for our meters(we have meters that collects info for our building)
2. And then i did a virtual IP Group, with all the meters
3. Then i setup Firewall policy

The issue i have is that i cannot access the meters when i am on another network(over internet).

Here is how i have setup the firewall, have i forgotten something. Must say i am not used to work with firewalls at all.

[Toshi_Esumi]

The VIP is for accessing from the Internet to wan1 interface. If the "another network" you're coming from is inside of this 60F (not from the internet), you need to have a hairpin NAT set up explained below:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-Hairpin-NAT-VIP/ta-p/195448

Toshi

[Zenhusen]

We are using VIP for accessing the meters via Internet, but cant access them over internet.  So when i said another network i meant internet, i will update the original question.

I can access the VIP when i am on the same network as the Firewall, and i am on that network outside the firewall
So i use the external ip adress then i can access it. But if i use another network/Internet I canot access it

[Toshi_Esumi]

Does sniffer show your access goes out to the interface where the meters are on with the correct port 80? That's the first thing to check.
Then if it's not going out, you probably need to run flow debug to see where it's going or why it's dropped.
https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/54688/debugging-the-packet-f...

Toshi

[Zenhusen]

Hi will check it tomorrow, one question . 
Sniffer i read briefly about it now, so what i understand i can see traffic, do I need to before i do sniffer try to access the meters from internet. Or do i only do a basic sniffer

[Toshi_Esumi]

The sniffer, not only FGT but any other kind like Wireshark, captures packet only when it's running. So you need to start capturing either GUI packet capture or CLI diag sniffer packet first, then while it's capturing you can try accessing one of the meters. Then when it fails, you can stop capturing then examine the output. For CLI sniffer, you might want to save the screenoutput of the terminal emulator you're using to SSH into it or console into it.

Toshi

[johnlloyd13]

hi,

try to disable/toggle the 'NAT' setting in the FW policy.

VIP will perform the inbound and outbound internet access for the VIP group.

[Toshi_Esumi]

If the default route at the destination is not coming back to the FGT, yes, changing the the source IP to the FGT itself with NAT is necessary. But if that's not the case, having NAT or no-NAT won't affect the incoming packets to reach the destination. Only returning packets direction might change.

At this moment, you don't know if it's going out toward the internal devices, which you need to confirm first.

Toshi

[ede_pfau]

IMHO the policy does not allow this traffic.

It needs to allow HTTP (port 80) and your custom service (tcp/10020). Please give it a try.

If unsuccessful, run a 'diag debug flow' to see what happens. Post it here for interpretation.

[funkylicious]

like @ede_pfau mentioned, if in the VIP you are using custom port forwarding then in the firewall rule I would set in the services option either ALL ( since you are using PubPort>PrivPort, 1:1 ) or those specific ports ( PubPort ) from the VIP in the services.