Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ATOON
New Contributor III

Request for Site Access via Specific Port

Hi,

 

Assistance with a network configuration. We have two internet modems in our current setup:

 

1. A fiber connection linked to the Forti WAN port.
2. A DIA with a static IP connected to Forti port number 4.

 

The internet is functioning correctly from the WAN port, now we need the user login to specified sites accessed exclusively through port number 4.

 

Modem: FortiWiFi 30E

Firmware: v6.2.15 build1378 (GA)

fori.jpg

3 Solutions
Toshi_Esumi

So far looks fine. Can you ping "fast.com"? Since I can ping it from my 40F, you should be able to. If not, try traceroute.

fg40f-utm (root) # exe ping fast.com
PING fast.com (23.5.241.75): 56 data bytes
64 bytes from 23.5.241.75: icmp_seq=0 ttl=55 time=19.7 ms
64 bytes from 23.5.241.75: icmp_seq=1 ttl=55 time=19.6 ms
64 bytes from 23.5.241.75: icmp_seq=2 ttl=55 time=19.6 ms
64 bytes from 23.5.241.75: icmp_seq=3 ttl=55 time=19.6 ms
64 bytes from 23.5.241.75: icmp_seq=4 ttl=55 time=19.6 ms

--- fast.com ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 19.6/19.6/19.7 ms

fg40f-utm (root) # exe traceroute fast.com
traceroute to fast.com (23.5.241.75), 32 hops max, 3 probe packets per hop, 84 byte packets
1 63.231.10.70 <tukw-dsl-gw70.tukw.qwest.net> 1.366 ms 1.881 ms 1.909 ms
2 63.226.198.41 <63-226-198-41.tukw.qwest.net> 2.014 ms 1.898 ms 1.900 ms
3 * * *
4 4.69.219.65 <ae2.3605.edge9.sanjose1.level3.net> 18.981 ms * *
5 4.14.32.70 <citigroup-i.bar2.sanfrancisco1.level3.net> 200.976 ms 124.634 ms 203.926 ms
6 * * *
7 * * *
8 23.5.241.75 <fast.com> 19.540 ms 19.830 ms 19.459 ms

 

Toshi

View solution in original post

AEK

In step 4 (firewall policy), destination should be All.

Then go to SD-WAN rules, and add the following rule:

  • source: all
  • destination: site1.com, site2.com
  • strategy: manual
  • interface preference: port4

Then add another SD-WAN rule "below" of the previous one:

  • source: all
  • destination: all
  • strategy: manual
  • interface preference: WAN

That will make things exactly in the way you requested.

AEK

View solution in original post

AEK
ATOON
New Contributor III

I found two cloud servers not running. All servers are now working fine.

View solution in original post

32 REPLIES 32
ATOON
New Contributor III

I awaiting the arrival of a new device model and I'll try this configured on it

AEK
SuperUser
SuperUser

Hello

If I understand well you need to:

  • Route access from internal user to siteA and siteB through port4
  • Route all other internet access through WAN port

Right?

Then you can for example integrate port4 and WAN interfaces in SD-WAN and configure all the above rules in a very simple way.

You can start here:

https://docs.fortinet.com/document/fortigate/6.4.15/administration-guide/889544/sd-wan-quick-start

AEK
AEK
ATOON
New Contributor III

Hi bro,

I followed the method you're mentioned in the above link, but I did not find in the method mentioned the way to add the sites that I wanted to open on port no# 4.

AEK

Hi Atoon

You specify the FQDN (site1.com, site2.com) in the Destination > Address field, and in the Interface Preference field you select port4.

AEK
AEK
ATOON
New Contributor III

Used this method with static route without success.

AEK

There is only one static route for SD-WAN interface, its default route uses SD-WAN interface.

In SD-WAN the routes are SD-WAN rules (as described in my above post) which are policy routes, so you don't need to add an extra static route towards site1.com and site2.com.

AEK
AEK
ATOON
New Contributor III

Regarding a method you've mentioned for accessing specific websites. I've implemented the approach, but unfortunately, I'm have an issue.
While the specific site is accessible and functioning as expected, I am unable to open other sites, such as Google or any sites.

 

1- Create a new address and add address needed.

2- Create SD-WAN ---> add WAN port and Port no# 4 as Interface Members

3- Create Static route as the below

 

Static.png

 

4- Create Policy ---> Incoming Interface (Internal), Outgoing Interface (SD-WAN), Source Address (All), Destination (Address added in step 1) and enabled NAT

AEK

In step 4 (firewall policy), destination should be All.

Then go to SD-WAN rules, and add the following rule:

  • source: all
  • destination: site1.com, site2.com
  • strategy: manual
  • interface preference: port4

Then add another SD-WAN rule "below" of the previous one:

  • source: all
  • destination: all
  • strategy: manual
  • interface preference: WAN

That will make things exactly in the way you requested.

AEK
AEK
ATOON
New Contributor III

Yes, it's worked now.

Another issue when adding the address site1.com it's worked, but when added as wildcard *.site1.com not work

AEK

There are some conditions for wildcard FQDN to work properly.

  • You have to use non encrypted DNS like DNS over TLS or DNS over HTTPS. So your clients have to use classic DNS
  • The DNS query and DNS response must transit through FGT, it means client and DNS server must be on different segments and separated by FGT

If those conditions are not met then wildcard FQDN will not work properly, and you will need to enter in FGT each of the subdomains, like sub1.site1.com, sub2.site1.com, and so ...

AEK
AEK
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors