publish web server

[#1]

Hi all. my name is guido. I' m trying to configure a FTG 100a on a network. this network have two private subnet assumed like DMZ and 1 internal. also there is a wan connection with a DSL (32 public addresses). now I' m trying to publish a web server placed onto a DMZ1 (192.168.0.a) in a specific public ip address. eg: 192.168.0.a -> 80.10.10.a I' ve added several Wan IP address on the wan1 interface. I' ve created a Virtual ip with static nat from specific external ip to a specific internal ip I' ve created a policy (without checking the NAT box) with source the specific IP address (80.10.10.a) and destination the Virtual IP created. unfortunately it not work... please, help.... many thanks in advance

[abelio]

hello guido and welcome,

I' ve added several Wan IP address on the wan1 interface.

you don' t need to do that; Define your wan by choosing one from your public ips You can use another IP for your webserver (or the same one if you wish) This article can help you: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=11765&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=21326709&stateId=0%200%2021328487 Also check: webserver' s default gateway, does it points to DMZ IP ? good luck

[#3]

hi Abel, many thanks for your quick reply. I' ve temporary resolved in this way: 1) I' ve created a VIP -static nat -source ip: one public ip - dest ip: ip address of the internal server 2) I' ve created a Policy Source Wan1 all destination VirtualIp (that I' ve created) it works now but I know that I' ve only workrounded the problem. In fact I use one public ip for every service (it is not right) in fact the final configuration I want to reach is simple, but i don' t know if it is possible with FGT. I' ve worked 10 years with Microsoft system, I am a MCSE and now ... with this appliance I feel like a rookie :) in a few words: I have 5 servers and 1 Blade Server (with 5 virtualized servers) each server hosts several services (web, mail, app, and so on) each server have an unique IP address (internal and private (192.168.x.x)) our dsl have 32 ip address. the questions are summarized with this two scenario: a) is possible to nat ONE public ip address (configured onto the WAN1 interface) to many private IP? b) even if one server host several web site of different customers, is possible to reach these web site using only one public IP? example: a) i have 3 domain registered onto my dns server: domain-1.com domain-2.com domain-3.com the DNS server map each domain on one and same public ip (WAN1): 2.10.10.100 the websites of the 3 domains are on different webserver with a unique ip (DMZ1): 192.168.0.200/201/202 the FTG will be able to catch the request (www.domain-X.com) and redirect it to the right IP b) i have 2 domain registered onto my dns server: domain-1.com domain-2.com the websites of these two domain are on the same server with IP (DMZ1): 192.168.0.99 the DNS server map each domain on one and same public ip (WAN1): 2.10.10.100 the FTG will be able to catch the request (www.domain-X.com) and redirect it to the server passing the domain request obviously every network card of the servers are configured with the correct GW. many many thanks guido

[rwpatterson]

What you need to do here is in the VIP configuration section, click the " port forwarding" box. This will allow you to use a single public IP for many different services. (One port forwarded VIP per service)

[abelio]

a) is possible to nat ONE public ip address (configured onto the WAN1 interface) to many private IP?

yes, and you could also balance traffic between internal servers hosting same websites. (if you use exactly the same IP configured in wan interface - i dunno why if you have 30 ip numbers available-, you' ll have to take care about firewall administrative ports)

b) even if one server host several web site of different customers, is possible to reach these web site using only one public IP?

yes; virtualhosting is a DNS / webserver topic. but your below example is more complex than that:

example: a) i have 3 domain registered onto my dns server: domain-1.com domain-2.com domain-3.com the DNS server map each domain on one and same public ip (WAN1): 2.10.10.100 the websites of the 3 domains are on different webserver with a unique ip (DMZ1): 192.168.0.200/201/202 the FTG will be able to catch the request (www.domain-X.com) and redirect it to the right IP

hummm, no; not yet; i guess you' re thinking in msisa server in this point. you can define a VIP 2.10.10.100:80 -> 192.168.0.200:80 and host on 192.168.0.200:80 as many virtualdomains as you wish. but you cannot send also the same port80 to another webserver hosting another website; you' ll need use another ports, ie: 2.10.10.100:81 -> 192.168.0.201:80

b) i have 2 domain registered onto my dns server: domain-1.com domain-2.com the websites of these two domain are on the same server with IP (DMZ1): 192.168.0.99 the DNS server map each domain on one and same public ip (WAN1): 2.10.10.100 the FTG will be able to catch the request (www.domain-X.com) and redirect it to the server passing the domain request

that' s the usual virtual hosting; no problem with that; strictly speaking, the FGT doesn' t catch the request www.domainX.com, it merely forward the packet by IP to the internal webserver; DNS and Apache/IIS do the rest. regards

[#6]

Hi all. thanks for your replies, but unfortunately something is went wrong. I' ve tried to follow your suggestion using only one public ip. but I can' t reach the services inside the private lan. in a few word I' ve tried to: scenario. a) public address 2.10.10.100 b) one server with IIS and mail server (two ip configured (192.168.0.55 / 56) c) IIS hosts 2 site and are published on one ip (192.168.0.55) d) pop3 and smtp are published on the same ip 192.168.0.56 tryin to create 2 vips with the same external ip source FTG give me an error of duplicate name. so I' ve crate 1 vip configuring on it a range (192.168.0.55 - 192.168.0.56) called " test" after I' ve created 2 policy 1st: -source Int: Wan1 -source Add: all -Dest Int: internal -Dest. Add: VIP " test" -sched: always -service http -NAT anc FIXED PORT DEselected 2nd -source Int: Wan1 -source Add: all -Dest Int: internal -Dest. Add: VIP " test" -sched: always -service Multiple (SMTP - POP3) -NAT selected anc FIXED PORT DEselected ....it not work. where is my error? thanks. Guido

[rwpatterson]

Once you create an entry without fixed port, no other VIP definitions can terminate on that IP. It' s one IP with all ports (one to one), or many with one port each (port forward). You cannot mix and match them. Corrected NAT to port forward....

[ede_pfau]

Actually, a VIP always does NAT - it exchanges the destination address of packets. Whether you enable NAT on the policy or not doesn' t matter in reaching an internal server from outside. Checking NAT in the policy where you use the VIP would translate the source IP of traffic across the policy as well; which sometimes is desireable and sometimes isn' t. For port forwarding VIPs only (as in ' contrary to non-forwarding VIPs' ), you need to check NAT for traffic from the private server to the internet. Otherwise, their private IP wouldn' t be routed anywhere. This is different for non-forwarding VIPs. Define multiple VIPs with the same external and internal IPs BUT check ' Port Forwarding' in each. SMTP is TCP/25, web is TCP/80 etc. Use these port specific VIPs in one or more policies - if you have one policy per service you can configure your UTM measures specifically. Please read the VIP chapter in the FortiOS Handbook for your FortiOS version, available for download from http://docs.fortinet.com . This will give you a reference for the options and some examples.

[#9]

ok, thanks!!

[#10]

so, if I well understand, i can' t publish several web sites (that reside on one phisical server) with only one public IP address. is it correct? thx