help - fortigate - failed redirecting address from 1 port to another port

[kssupport]

hello there,

need help please.

 we use Fortigate FG-30E.

we have 2 subnet in different port.

subnet 192.168.0.0 /24 in port 1

subnet 192.168.100.0/24 in port 2

there is 1 host in port 2 with IP 192.168.100.1 as web server.

We want for all user in port 1 , enter web address 192.168.100.1, it will redirect to host 192.168.100.1 in port 2.

we have configured:

1. add IP Policy from port 1 to port 2:

- SOURCE: SUBNET 192.168.0.0/24

- DESTINATION:SUBNET 192.168.100.0/24

- NAT ON

- SERVICE ALL, time always.

- accept

2. add IP Policy from port 2 to port 1:

- SOURCE: SUBNET 192.168.0.0/24

- DESTINATION:SUBNET 192.168.100.0/24

- NAT ON

- SERVICE ALL, time always.

- accept

3. set Policy route

 - incoming : port 1

- destination: subnet 192.168.100.0/24 , address: 192.168.100.1

- action: forward traffic

- outgoing interface: port 2 ; gateway: 192.168.100.1

result failed.

please advice. what we've missed here. thanks in advance

[akileshc]

Hello,

The configuration part looks fine, It's better to understand the traffic flow on Fortigate before considering any changes. 

But, the gateway IP address configured in policy route "192.168.100.1" is a server itself hosted behind Port2 or an IP address configured on the Interface Port2? (I believe the Policy route isn't required in this case)

Run the below-mentioned commands on Fortigate simultaneously on two different SSH sessions and then initiate the traffic. 

SSH1:

get sys status

di ip address list 

get router info routing-table all

diagnose debug reset

diagnose debug disable

diagnose debug console timestamp enable

diagnose debug flow show fun en

diagnose debug flow filter clear

diagnose debug flow filter addr 192.168.100.1

diagnose debug flow trace start 1000

diagnose debug enable

After connection failed, disable the logs by executing

diagnose debug disable

SSH2:

# diagnose sniffer packet any "host 192.168.100.1" 4 0 a 

[kssupport]

hi.

gateway in policy route is a server itself.

thanks.

[akileshc]

Hello,

Then you may remove the policy route that doesn't appear to be necessary at this moment and gather the debug and sniffer logs.

[upadhyeasimit]

- Need to change SRC & DEST for policy 2 

- Not sure why NAT is required

- Pls share below details

get system arp

get router info routing-table details

show firewall policy