routing between internal networks via external interface?

[andrwsL]

Hello, I have a setup with 2 isp' s and two internal networks on fortigate 100c in NAT mode. Internal network1 is public guest network and is nated to isp1, internal network2- to isp2. Network1 doesn' t have any access to network2. There is a bunch VIP' s configured on both external interfaces, from which some specific ports are nated to internal network2. I wish to provide access from guest network1 to service in network2 via VIP on ISP2 interface. Why do i want it such way? Guest network1 is using isp' s dns servers, and i dont want to allow accessing network2 internal dns servers, or to lose fortigate' s protection capabilities. Thanks in advance for any tips.

[rwpatterson]

Welcome to the forums. Does it not work now? What have you tried?

[andrwsL]

No, it doesn' t. traceroute from net1 to my desired VIP times-out somewhere on the ISP1 network. I tried to add policy routes (before default policy route from net1): from net1 to desired VIP via ISP2 interface ip or gateway, from external ip on ISP1 to desired VIP via ISP2 interface ip or gateway. And both ways the traceroute times-out somewhere on the fortigate. What policy route should i add?

[rwpatterson]

Skip the policy route. Remove them all and add the below: Source interface: WanX Source subnet: WanX subnet (the internal subnet) Destination interface: WanY Destination subnet: WanY VIP Service: whatever you need... NAT: off This needs to be done on the smaller boxes it seems. I had to do the same on a FWF60AM some time back. Others have followed and it seems to work for them as well.

[andrwsL]

Do i understand you correct, you suggest to remove policy routes and to add firewall policy? I did that (except removing default net1 policy route)- tried to add any combinations of src/dst interfaces/ip' s/subnets and it had no effect- traceroute dissapears on ISP1 network, and firewall policy counters are zero after trying to access VIP.

[rwpatterson]

Remove the policy routes that are trying to accomplish this goal. You should be able to get this done with static routes and policies. NOTE*** I need to amend my replies. The unit I was doing this with had one WAN connection, you have 2. You will need the addition of the policy routes.

[andrwsL]

So anyone has idea what policy routes and firewall policies i should add?

[RafalS]

Hi andrwsL!

I wish to provide access from guest network1 to service in network2 via VIP on ISP2 interface. Why do i want it such way? Guest network1 is using isp' s dns servers, and i dont want to allow accessing network2 internal dns servers, or to lose fortigate' s protection capabilities.

To me, your design seems not the simplest possible with your objectives stated above. Remember that by default Fortigate discards packets on interfaces where their src IPs are not supposed to appear. Even though you use VIPs on the outside, I suppose it won' t work without changing this RPF from strict (default) to loose and this possiblility seems reserved for different purposes anyways. But then again, I don' t like the idea of externalizing the inner traffic. The routing between interfaces is already there so why don' t you just allow desirable communication from NET1 to NET2 with regular FW polices and rely on implicit deny for the rest, including internal DNS? IMHO, this case should involve internal interfaces only, unless I' m missing something from your description, then pls let me know. Cheers! Rafal

[morrack]

I also think you' re going for a complicated solution when a simple one is available. If I understand your original post correctly, your only reason for not simply setting up firewall rules to allow direct traffic is DNS. I would simply setup a local DNS server on the fortigate that has the handful of entries you would need to customize. The guest network can be configured to use this DNS " server" as their first choice, then recursivley use the ISP DNS server for anything that isn' t matched locally.