port 2 === LAN === [ FortiGate ] === port 1 ---- ISP1=== port 3 ---- ISP2
config firewall policy
edit 1 set srcintf "port2" set dstintf "port1" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ANY" set nat enable next edit 2 set srcintf "port2"
set dstintf "port3" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ANY" set nat enable next end config router policy
edit 1 set input-device "port2" set protocol 6 <<< PROTOCOL TCP set start-port 80 <<< set end-port 80 <<< TCP PORTS set gateway 172.31.225.254 <<< ISP2 gateway set output-device "port3" next edit 2 set input-device "port2" set protocol 6 set start-port 443 set end-port 443 set gateway 172.31.225.254 set output-device "port3" next end config router static edit 1 set device "port1" set gateway 192.168.183.254 set weight 50 next end |
S* 0.0.0.0/0 [10/0] via 192.168.183.254, port1, [0/50] C 10.160.0.0/23 is directly connected, port2 C 172.31.224.0/23 is directly connected, port3 C 192.168.182.0/23 is directly connected, port1 |
PING 172.31.225.254 (172.31.225.254): 56 data bytes 64 bytes from 172.31.225.254: icmp_seq=0 ttl=64 time=0.2 ms |
1.033504 port2 in 10.160.0.10 -> x.39.139.53: icmp: echo request 1.033530 port1 out 192.168.182.110 -> x.39.139.53: icmp: echo request 4.100644 port2 in 10.160.0.10.2168 -> x.2.2.1.53: udp 42 4.100711 port1 out 192.168.182.110.32988 -> x.2.2.1.53: udp 42 |
50.378968 port2 in 10.160.0.10.2206 -> x.70.202.225.80: syn 2697527219
50.379013 port3 out 172.31.224.110.47162 -> x.70.202.225.80: syn 2697527219 50.594652 port3 in x.70.202.225.80 -> 172.31.224.110.47162: syn 3654649874 ack 2697527220 50.594698 port2 out x.70.202.225.80 -> 10.160.0.10.2206: syn 3654649874 ack 2697527220 88.275430 port2 in 10.160.0.10.2215 -> x.39.139.188.443: ack 3459018393 88.275441 port3 out 172.31.224.110.55299 -> x.39.139.188.443: ack 3459018393 88.278017 port2 in 10.160.0.10.2215 -> x.39.139.188.443: psh 1598472 ack 3459018393 88.278024 port3 out 172.31.224.110.55299 -> x.39.139.188.443: psh 1598472 ack 3459018393 |
id=36870 trace_id=21 msg="vd-root received a packet(proto=6,10.160.0.10:2232 >x.115.88.31:80) from port2." id=36870 trace_id=21 msg="allocate a new session-0000017f" id=36870 trace_id=21 msg="Match policy routing: to 172.31.225.254 via ifindex-4" id=36870 trace_id=21 msg="find a route: gw-172.31.225.254 via port3" id=36870 trace_id=21 msg="find SNAT: IP-172.31.224.110, port-49180" id=36870 trace_id=21 msg="Allowed by Policy-2: SNAT" id=36870 trace_id=21 msg="SNAT 10.160.0.10->172.31.224.110:49180" |
Related Articles
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.