forward WAN to LAN by FQND

[Arnold]

Hi, I wnted to know those 60C with firmware 5.0 support such a feature as forward specific request to different ip' s but to the same port depending on the FQDN as in Forefront Threat Management Gateway for example if they enter adress1.company.com port forward to host 10.0.1.10:3389 and if they enter adress2.company.com port forward to host 10.0.1.11:3389

[rwpatterson]

Welcome to the forums. What you are asking for is called Virtual IP with Port Forwarding. It' s available to all Fortigate platforms and versions at the current time.

[Arnold]

yes Virtual IP can forward IP/WAN to IP/LAN, but can' t forward it by FQDN/WAN to IP/LAN

[rwpatterson]

FQDN to IP is a DNS function. This is not directly done by the FGT unit on the Internet level.

[Arnold]

ok, I probably wrote a dad example lets say I have a pc' s named remotecomputer0 10.0.1.5 and remotecomputer1 10.0.1.6 we have an external address of 8.8.8.8 with a domain company.com now our clients connect via remote.company.com:5000 witch forwards the request to 10.0.1.5:3389 remote.company.com:5001 witch forwards the request to 10.0.1.6:3389 we want to achieve: we wuld register the computers as a submarine to resolve to 8.8.8.8 FGT would " listen" on port 3389 and if it gets an request for PC1.company.com:3389 it wuld forward it to 10.0.1.5:3389 PC2.company.com:3389 it wuld forward it to 10.0.1.6:3389 similar to IIS bind, if you bind an address myname.company.com to the pc pc1.company.com wihth an IP adress of 10.0.1.5 IIS will only accept request to myname.company.com, and will not accept request nether to pc1.company.com or to 10.0.1.5

[rwpatterson]

You wish the FGT to read the header and forward based on what it reads in there. As far as I know, the FGT cannot do this. It was proposed for V5, but I' m not on that level of code as of yet. Perhaps someone else who is can chime in.

[Dave_Hall]

Perhaps DNS translation is what you want, assuming there is no internal DNS server on your network and you want your internal computers remote connecting to those two " servers" by hostname.

[Arnold]

We have an external and an internal DNS' s servers I think DNS translation is the thing we are looking for, still not sure how those this part work thou: " the reply is translated on the FortiGate unit into 10.73.1.37, which is the private IP address of the same resource, " server1" ."

[Arnold]

emm, as I understand this is just for the internal users, externally it will still get the public IP...

[Dave_Hall]

Pretty much. Still not exactly sure what you are requesting here -- it seems you are requesting something that is akin to setting up two VIPs, but want some sort of DNS translation in the mix. As Bob pointed out this is not how the fgt works. Ideally, and assuming your company has more than one public IP address, you can set up pc1.company.com and pc2.company.com to resolve to two public IPs (one could be the fgt' s WAN IP) that are routed to the fgt' s WAN interface then set up two VIPs from there to point to the real machines. (Maybe someone has a better solution.)

 remote.company.com:5000 witch forwards the request to 10.0.1.5:3389
 remote.company.com:5001 witch forwards the request to 10.0.1.6:3389 

The above is pretty much how we set up remote desktop connections on our fgt boxes.