unreachable wan ip adress from internal lan

[fsv99er]

Hy, Since a few weeks we have a fortigate 100D. Everything worked very fine. But now we have a big Problem. We have a WAN Ip Adress 212.xxx.xxx.xxx. This IP is reachable from the Internet. All works fine. But if my Device has an internel LAN IP Adress 192.xxx.xxx.xxx we cant reach the WAN IP Adress. What can i do that the WAN IP adress ist reachable from the LAN ? Is this a routing Problem ?

[fsv99er]

very blind ? :D

[fsv99er]

Name VIP SERVER Type Subnet Subnet / IP Range 192.168.0.9 (ip of the internal server) Interface lan Show in Address List YES

[TheJaeene]

Please provide us the CLI Output of: -> sh firewall policy -> sh firewall vip Dont Forget to obfuscate your official IPs :D

[fsv99er]

hy, 212.xxx.xxx.xxx is the external ip sh firewall policy config firewall policy edit 3 set srcintf " mobilvpn" set dstintf " lan" set srcaddr " VPN_Range" set dstaddr " Internal_Range" set action accept set schedule " always" set service " ALL" set nat enable next edit 4 set srcintf " lan" set dstintf " mobilvpn" set srcaddr " Internal_Range" set dstaddr " VPN_Range" set action accept set schedule " always" set service " ALL" set nat enable next edit 6 set srcintf " lan" set dstintf " wan1" sh firewall vip config firewall vip edit " OWA" set extip 212.xxx.xxx.xxx set extintf " any" set portforward enable set mappedip 192.168.0.9 set extport 443 set mappedport 443 next edit " Port01 TCP" set extip 212.xxx.xxx.xxx set extintf " any" set portforward enable set mappedip 192.168.0.12 set extport 8080 set mappedport 8080 next edit " Port02 TCP" set extip 212.xxx.xxx.xxx set extintf " any" set portforward enable set mappedip 192.168.0.12 set extport 8050 set mappedport 8050 --More-- next --More-- edit " Port03 TCP" set extip 212.xxx.xxx.xxx set extintf " any" set portforward enable set mappedip 192.168.0.12 set extport 3232 set mappedport 3232 next end

[TheJaeene]

Try a " lan -> lan" fw policy that allows " any" since you bound the vip to " any" interface (seems that the Output of policy #6 is truncated

[TheJaeene]

My Last post was confusing... Need to grab some eat.. Create a policy from LAN to LAN allowing all Services to all destinations...

[fsv99er]

Big big thanks for your help ! Now i can reach my external ip from a internal ip But not with the LAN to LAN with all services. I create a police from Lan to Lan with the VIP as Destination

[emnoc]

Suggestions:

But not with the LAN to LAN with all services.

Use diag debug flow with the correct filters, post the output of that diagnostic flow trace checking ordering of fwpolicies checking if SNAT is required or not