fortigate virtual ip cant access from outside

[Zenhusen]

I have replaced the current firewall an old 50E with a new 60F
Sadly we could not use the config file from the old one.

1. I have setup VirtualsIP for our meters(we have meters that collects info for our building)
2. And then i did a virtual IP Group, with all the meters
3. Then i setup Firewall policy

The issue i have is that i cannot access the meters when i am on another network(over internet).

Here is how i have setup the firewall, have i forgotten something. Must say i am not used to work with firewalls at all.

[ede_pfau]

IMHO the policy does not allow this traffic.

It needs to allow HTTP (port 80) and your custom service (tcp/10020). Please give it a try.

If unsuccessful, run a 'diag debug flow' to see what happens. Post it here for interpretation.

[funkylicious]

like @ede_pfau mentioned, if in the VIP you are using custom port forwarding then in the firewall rule I would set in the services option either ALL ( since you are using PubPort>PrivPort, 1:1 ) or those specific ports ( PubPort ) from the VIP in the services.

[Zenhusen]

Chnaged the service option to all and no chnage cant access from intenet

[GauravPandya]

In the policy, disable NAT and put VIP object e.g "Elvaco Nr 1"in the destination field. Try to access from internet.

[yderek]

@Zenhusen  Try to run the flow debug while you connecting from outsite 

CLI1 : 

==================================================

diagnose sniffer packet any "host x.x.x.x && host y.y.y.y && port zzz" 4 0 l

Replcae x.x.x.x with your external computer public IP , y.y.y.y will be your FG WAN IP configured in VIP, zzz will be the port number of service 

attempt to access the VIP from Internet and let debug run 

To stop this debug using ctrl+c 

==================================================

CLI2:

diagnose debug reset

diagnose debug flow filter saddr <your external source IP from computer trying to access>

diagnose debug flow filter daddr < your vip external IP configure on FG>

diagnose debug flow show function-name enable

diagnose debug flow trace start 2000

diagnose debug enable

==================================================

attempt to access the VIP from Internet and let debug run , try to access from internet couple of time 

==================================================

To stop the debug using 

==================================================

dia de dis 

dia de reset 

==================================================

Upload CLI 1 and 2 in this topic after

[Zenhusen]

I tried the above but got nothing from cli afte i did the above