port-forwarding "A duplicate entry already exists" problem...

[KAKAO]

I set extip 3.3.3.1 / set extintf "wan1" / portforward enable / mappedip "192.168.10.10" / extport 843 / mappedport 843.

And I can't set extip 3.3.3.1 / set extintf "wan1" / portforward enable / mappedip "192.168.10.20" / extport 843 / mappedport 843.

I got the message "A duplicate entry already exists"

How can i fix this problem...?

Fortigate( Port-forwarding ) can't use duplicate mappedip??

Give me your advice

Thank you

Kim.

[Kenundrum]

You can't map two virtual IPs to the same external IP/port. The system wouldn't know which VIP to use to handle the traffic. The system creates a listener on the external IP/port that handles the forwarding, you can't have two different things listening on the same port and therefor you get the duplicate error.

The way to do this is to either change the external IP or the port of one of the VIP port forwards.

For example, 3.3.3.1:843->192.168.10.10:843 and 3.3.3.1:844->192.168.10.20:843

This will allow you to have the internal application still listen on the correct port and the fortigate will translate the port. The external application will have to be aware of the port change and remap appropriately.

The other option is to assign an additional external IP address if changing the port is not possible on the application.

I have used this method numerous times and it works well. Internally, the application continues to work as expected with no port changing needed, but external connections need to tweak the port number.

-Edit-

If you're trying to send traffic to both servers for load balancing, you need to use a load balance rule. The above example is for the same application trying to access two separate systems.

[KAKAO]

Thank you.

감사합니다 ^^