Fortigate behind existing firewall not receiving VPN connection due to private WAN IP

[ABE_63]

I am running some tests trying to connect a client workstation to another client that sits behind my Fortigate. The trouble is, the Fortigate connects out to the internet via an existing firewall (edge). Therefore the Fortigate is receiving a Private IP from the edge firewall on it's WAN interface. I have proven that I can establish a VPN connection to WANs private IP when connecting the client to the LAN of the edge firewall but now I want to prove that I can create a VPN connection from anywhere in the world. When I enter the public IP address of the edge firewall into Forticlient, I get an error saying VPN down. What must I do to be able to connect from a client in a different location over the internet, through the edge router, into the fortigate and to the "accessible LAN"?

[ozkanaltas]

Hello @ABE_63 ,

If you configure Destination NAT to Fortigate private IP addresses on your edge firewall.  This should be work. After doing this configuration, you can connect your FortiGate for SSL VPN.

[jiahoong112]

For this, you can use DDNS for sslvpn purposes. Kindly refer here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-DDNS-for-SSL-VPN/ta-p/194137 

[Toshi_Esumi]

I wouldn't think the DDNS works when the FGT's wan interface gets a private IP from the GW/NAT device in upstream. I believe DDNS works only when the FGT's wan interface gets a public IP that is reachable from the internet, but it's dymamic and keeps changing time to time.

Toshi

[kcheng]

Hi @ABE_63 

First thing that I would advise you to check is the reachability of the FortiGate SSLVPN service from the external connection. Since the FortiGate is receiving a private IP from the upstream device, NAT should be performed on your upstream device. You can attempt to troubleshoot the respective via the following steps:

1. Obtain the public IP of you client where VPN Client is installed. (https://ipchicken.com)

2. Run sniffer on the FortiGate either with CLI console or SSH session:

diag sniffer packet any "host <client public IP> and port <SSLVPN port>" 4 0 l

** Replace client public IP with the result you obtained in step 1, and the port you configured for SSLVPN access

3. If you do not observe output from the above step, the edge device would be where you need to further troubleshoot.

4. If you observe output from the above step, then you will have to enable sslvpn debug to check further on the actual root cause:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-Troubleshooting/ta-p/189542

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Possible-reasons-for-FortiClient-SSL...

[hbac]

Hi @ABE_63,

Yes, you can use DDNS as mentioned by jiahoong112. It will work even though your FortiGate WAN interface doesn't have a public IP address. Users can use DDNS domain name to connect to the VPN. 

You also need to make sure that the edge firewall forwards incoming traffic from the Internet to the FortiGate. 

Are you using SSL or IPsec VPN? What is the error message when connecting?

Regards, 

[Toshi_Esumi]

Ok, So you're saying the FortiGuard side, not the FGT side, keeps learning the public IP (NAT outside IP) the FGT is coming from and set that IP with the DNS name. I'll test that to confirm.

Thanks,

Toshi

[hbac]

@Toshi_Esumi,

Yes, there is an option to use public IP when enabling DDNS and the DNS record will keep changing dynamically based on that public IP. 

Regards, 

Regards, 

[Toshi_Esumi]

It's confirmed that DDNS works behind a NAT device. The "set use-public-ip enable" is required when the wan interface is behind a nat device in upstream.

config system ddns
  edit 1
    set ddns-server FortiGuardDDNS
    set ddns-domain "xxx.fortiddns.com"
    set use-public-ip enable
    set monitor-interface "wan1"
  next
end

Toshi

[ABE_63 · Accepted solution]

Many thanks for your help. I found @kcheng post helpful in narrowing down where i needed to troubleshoot. Having already tried to configure DDNS and finding that it didn't work, my suspicions led me to believe that this wouldn't work using a private IP alone. I then followed @ozkanaltas guidance, created a forward rule: 

Source: <FortiClient machine public IP>, port: 443,

Forward IP: <Local LAN IP assigned to Fortigate WAN interface>, Forward port: 443, Protocol: TCP.

After applying this rule and running the sniffer on the fortigate "diag sniffer packet any "host <client public IP> and port 443" 10di 0 l" the connection still didn't work. It was only when i followed @jiahoong112 guidance on setting DDNS again that a connection was established and I could see traffic in the FortiCLI sniffer.

As a side note: When I originally tried this, I had configured the port as 10443 in both the FortiClient, the Forwarding rule on the edge router and in the SSL VPN Settings. For some reason this did not work. It's possible that I may have missed something. But at least I have it working and can circle back to that another time. Thanks again for all the help!