NAT Issue

[Law_Kumar]

Hi, We have Fortigate 300C. One of the system have sql client installed on it which connects to SQL server with public IP which is at a different location. Yesterday I allowed RDP for this system by Static NAT with one of the public IP available at my location. When I did enabled the policy for the static NAT from outside --> sql client system, my sql client is not connecting to the sql server. But when I disable the NAT policy it starts working. Kindly help.

[ede_pfau]

Can you post your relevant configuration please: - WAN interface IP and netmask - VIP for RDP access - policies: int->WAN to server and WAN->int for RDP

[Law_Kumar]

Hi ede, Here' s the required details, -WAN interface IP and Subnet, ==[port2] mode: static ip: 115.113.189.2 255.255.255.192 ipv6: ::/0 status: up speed: 100Mbps (Duplex: full) -VIP for RDP Access config firewall vip edit " 192.168.11.76_13.249" set extip 115.113.189.28 set extintf " port2" set mappedip 192.168.13.249 next -Internal to WAN (to sql server) Policy config firewall policy edit 28 set srcintf " port1" set dstintf " port2" set srcaddr " VM_192.168.13.249" set dstaddr " 80.71.225.53:28666" set action accept set schedule " always" set service " 28666" " Allowed_Services" set logtraffic enable set nat enable next - WAN to Internal (sql client PC) Policy config firewall policy edit 31 set srcintf " port2" set dstintf " port1" set srcaddr " all" set dstaddr " 192.168.11.76_13.249" set action accept set status disable set schedule " always" set service " ANY" set logtraffic enable next I have diabled policy 31 WAN to Internal currently for sql client to server connectivity. When enabled my connectivity goes down.

[ede_pfau]

Your config looks OK. As you are only forwarding RDP you could modify the VIP to be portforwarding: ext port: 3389 mapped port:3389 and ' set service RDP' in policy 31. And re-test. The only other reason for a malfunction I can think of is on the client itself.

[Law_Kumar]

Thanks a lot Ede. The issue has resolved.

[Law_Kumar]

Thanks Ede. I' ll test it tomorrow and will let you know.

[ede_pfau]

Super! For all that follow this thread: was it resolved because of additional port forwarding, or for other reasons?

[Law_Kumar]

It was resolved because of additional port (RDP) forwarding. I was allowing any traffic from outside, due to which the SQL traffic was coming via another Public IP and SQL client was not able to connect.