publish web server

[#1]

Hi all. my name is guido. I' m trying to configure a FTG 100a on a network. this network have two private subnet assumed like DMZ and 1 internal. also there is a wan connection with a DSL (32 public addresses). now I' m trying to publish a web server placed onto a DMZ1 (192.168.0.a) in a specific public ip address. eg: 192.168.0.a -> 80.10.10.a I' ve added several Wan IP address on the wan1 interface. I' ve created a Virtual ip with static nat from specific external ip to a specific internal ip I' ve created a policy (without checking the NAT box) with source the specific IP address (80.10.10.a) and destination the Virtual IP created. unfortunately it not work... please, help.... many thanks in advance

[rwpatterson]

The Fortigates only pass the traffic. They don' t read the HTTP header. That' s a function of the web server software. If the web server can direct the traffic based on the header information, then yes you can do it. One outside IP address can host multiple domains IF the web server can do the distribution. The FGT cannot. (prior to V4.3.x)

[#3]

hmm this is a problem. I have two web server on my dmz: e.g. www1 192.168.0.1 with 5 website www2 192.168.0.2 with 10 website if I want to use only one public ip address I have to change the wwww port on the servers?

[rwpatterson]

Or have the primary redirect to the secondary. Or change the DNS entry on one to a unique IP address (if you do have 30)

[thors_hammer]

Hi Guido, if you have two webservers with

www1 192.168.0.1 with 5 website www2 192.168.0.2 with 10 website

that sounds like you are using the http-request-header/DNS-name to let the server decide which Website it presents for the request. If so, you can configure 2 VIP with port forwarding for port 80 - one with destination www1 - one with destination www2 Before you can configure the VIPs, check that there is no other VIP with the same external IP (and port forwarding disabled) or the same name. In the external dns you will have to use the VIP1 for www1 and VIP2 for www2. The FGT passes the full request to the webserver, which has to decide which site to present (using the dns-name from the request header) So you can use the to public IPs for other services than port 80, too. Let' s say smtp/25. Therefor you have to configure a third VIP with port forwarding for port 25 and as destination the ip of your mailserver. Some or other than your webserver. The VIP on the Fortigate always does a port forwarding, but if you leave the point unchecked, it forwards ALL ports. With the point checked the NAT is limited to the port configured in the VIP settings. Hope that helps!

[#6]

Thank you, thors_hammer it works! great! now I' m able to use only one ext IP to serve several website. I have had this problem because I' ve installed Parallel Platform. It generate several websites (and other services) on the same machine (even if it is a virtualized platform) and on a single IP (I can use multiple IP if I need). last question: may I use only one policy (e.g. www instead of www1 and www2) using a pool of ip instead a single IP? it will work?

[Jan_Scholten]

Having lots of Websites on one host (and one IP) is pretty usual nowadays. On my server are currently running more than 50 Domains. If you have 2 hosts you need two VIPs and therefore 2 policys (you can only choose one vip per policy). Just be sure the DNS resovles the domains to the correct ip. (10 domains for Host 1 5 domains for host 2) If don' t do port forwarding but static nat you can also access ssh, mail aso on each host without doing more and more port forwarding vips. I' d handle it without port forwarding of specific ports if you have enough IPs. What can be a problem is if you are having multiple ssl enabled sites on a hosts, as a certificate is exchanged before the hostname is transferred. There is a Technique called SNI (http://en.wikipedia.org/wiki/Server_Name_Indication) but this is not support in all server software/ all browsers.