Multiple IP' S

[fabioloc]

Hi everyone! I' m trying to configure a fortigate 110c and i need this kind of help. I' v got 1 ADSL with 8 different static IP. - 1 is for the router (xxx.yyy.zzz.209) - 1 is for the wan1 interface of firegate (xxx.yyy.zzz.211) I need to configure on the wan1 interface, 2 other static IP (xxx.yyy.zzz.212 and xxx.yyy.zzz.213) and then create different policies, for example, that gain me the possibility to route the 3389 port (RDP) to different internal servers depending on the Static IP source. In this example: rdp on xxx.yyy.zzz.212 ----> internal ip 192.168.1.10 rdp on xxx.yyy.zzz.213 ----> internal ip 192.168.1.15 I can' t find the right way.. I' v got enable overlap to configure secondary ip address on the wan interface. I created 2 vlan for the 2 different static ip. Then I made a policy where SOURCE is the vlan just created and the destination is an address, but dosen' t work. And i can' t make a virtual IP where the external interface is the vlan, because when i enable port forwardind over the 3389 port, he say me " A duplicate entry already exist" . What can i do? Sorry for my english, i know is not very good writing... Thank' s a lot! Fabio Locati

[Carl_Wallmark]

Your answer is: Virtual IP 1. Go to Firewall -> Virtual IP 2. create a new VIP, 3. Enter a name 4. Choose your external interface (in your case WAN1) 5. Enter the External IP you want to use 6. Enter the IP of the server on the inside 7. Click " Port forwarding" 8. Choose TCP and enter 3389 in the to boxes to the right 9. Save, and then goto Firewall -> Policys 10. Create a new policy that look like this: Source Interface: WAN1 Source Address: Any Destination Interface: Internal Destination Address: <the name of your VIP> Service: RDP Schedule: Always Status: Accept Save the policy and you are done ! BTW, you dont need to add secondary ips to your interface, remove them and unset the subnet overlap command.

[fabioloc]

Thank you very much! It' s ok! I added also a " tick" to enable NAT, in the policy created, because without the tick it doesn' t work. It' s ok in your opinion? Best regards! Fabio

[Carl_Wallmark]

Hi, on virtual ip' s, you should NOT " tick" the NAT, if doing so, every connection will be logged as the ip of the internal interface on your servers. NAT is commonly used when the traffic is going out from your network, never in (unless there is a special reason for it of course).

[#5]

Thank you very much!