problem with VIP

[AfonsoAndrade]

I can not create a routing IP / Port of the WAN2 port to Internal1. I did the VIP configuration: config firewall vip edit " VIP_DVR_NEBLON_9190" extintf set " WAN2" September PortForward enable September mappedip 192 168 112 241 extport September 9190 mappedport September 9190 next edit " VIP_DVR_NEBLON_8101" extintf set " WAN2" September PortForward enable September mappedip 192 168 112 241 extport September 8101 mappedport September 8101 next edit " VIP_DVR_NEBLON_80" extintf set " WAN2" September PortForward enable September mappedip 192 168 112 241 September 80 extport September 80 mappedport next end Added in the Grupo: config firewall vipgrp edit " GVIP_DRV" set interface " wan2" set member " VIP_DVR_NEBLON_80" " VIP_DVR_NEBLON_8101" " VIP_DVR_NEBLON_9190" next end Create the policy: config firewall policy edit 13 set srcintf " wan2" set dstintf " internal1" set srcaddr " all" set dstaddr " GVIP_DRV" set action accept set schedule " always" set service " SERV_DVR" " HTTP" set logtraffic all next end But, i can not access by wan2. Access test: FG40C-Caltex-Leblon # diagnose sniffer packet wan2 ' port 9190' 4 18 interfaces=[wan2] filters=[port 9190] 5.050976 wan2 -- 201.63.86.100.50982 -> 201.17.90.133.9190: syn 1289710876 8.052829 wan2 -- 201.63.86.100.50982 -> 201.17.90.133.9190: syn 1289710876 11.730041 wan2 -- 201.63.86.100.50999 -> 201.17.90.133.9190: syn 1836412954 14.056142 wan2 -- 201.63.86.100.50982 -> 201.17.90.133.9190: syn 1289710876 14.735218 wan2 -- 201.63.86.100.50999 -> 201.17.90.133.9190: syn 1836412954 20.743191 wan2 -- 201.63.86.100.50999 -> 201.17.90.133.9190: syn 1836412954 26.064795 wan2 -- 201.63.86.100.51059 -> 201.17.90.133.9190: syn 603028884 Could you help me?

[emnoc]

diag dbeug reset diag debug flow filter port 9190 diag debug flow show console enable diag debug flow trace start 1000 diag debug enable Try the above and review that fwpolicy and the service definitions. Since packets are getting to you as seen by the packet dump, we can rule out routing or any upstream filters Also you VIP config looks a little distorted but I' m sure you meant; set extip x.x.x.x set extif wan2 etc...

[AfonsoAndrade]

TKS....!!!!!!! I checked the firewall policy blocked the communication. Only works when I put all the services option. Notify me knows I have a problem with security, maintaining the rule?

[emnoc]

what did you define for " SERV_DVR" ? And how did you define it? You probably want or should apply a service group for the those ports and a custom port.

[Dave_Hall]

Only works when I put all the services option.

Looks like your VIPS are configured for port-forwarding, so there is no real need to define a service in the actual firewall policy. If you need to define a service (group), make sure it covers the all the ports used by the various VIPS. Also make sure (if needed) the source port is 0-65535 when defining custom service(s).