webserver in dmz, outgoing connection to wan1 not working, via wan2 working okay?

[Peter_IT]

Dear fellows, I hope you can help me with the following setup. I want to give my webserver (connected to dmz) access to the internet via wan1 and wan2. The webserver must have internet access through wan1 and wan2, in case wan1 dies for some reason. Internet requests to the webserver are okay, I can access the webserver from the outside via wan1 and wan2. But when want to browse on my webserver, I only have an outgoing connection throught wan2 and not wan1. My setup: 2x Fortigate 60 (master/slave cluster) dmz -- 192.168.10.254 / 255.255.255.0 --> webserver in dmz -- 192.168.10.6, default gateway 192.168.10.254 internal -- 192.168.0.220 / 255.255.255.0 wan1 (cable) -- 213.125.xxx.xxx / 255.255.255.248 (seperate ISP router and ISP modem) wan2 (ADSL) -- 213.201.xxx.xxx / 255.255.255.248 (integrated modem/router) Static Route: IP 0.0.0.0 mask 0.0.0.0 gateway 213.125.xxx.xxx device wan1 IP 0.0.0.0 mask 0.0.0.0 gateway 213.201.xxx.xxx device wan2 Policy Route: Incoming internal Outgoing dmz Source 192.168.0.0 / 255.255.255.0 Destination 192.168.10.0 / 255.255.255.0 (LAN to dmz webserver) Incoming internal Outgoing wan1 Source 192.168.0.0 / 255.255.255.0 Destination 0.0.0.0 / 0.0.0.0 (LAN to wan1) Incoming internal Outgoing wan2 Source 192.168.0.0 / 255.255.255.0 Destination 0.0.0.0 / 0.0.0.0 (LAN to wan2) Firewall Policy dmz -> internal source (webserver 192.168.10.6) destination all schedule always service any action accept (webserver to lan, NAT enabled, works okay) dmz -> wan1 source (webserver 192.168.10.6) destination all schedule always service any action accept (webserver to wan1, DOESN' T WORK, NAT enabled, tried also to disable NAT) dmz -> wan2 source (webserver 192.168.10.6) destination all schedule always service any action accept (webserver to wan2, works okay) internal -> dmz (works okay) internal -> wan1 (works okay) internal -> wan2 (works okay) wan1 -> dmz (HTTP, HTTPS, FTP works okay) wan2 -> dmz (HTTP, HTTPS, FTP works okay) So, everything works, except the connection from my webserver inside dmz to the internet via wan1 (cable). If I disable dmz -> wan2 I have no more internet connection. I can ping the cable modem (wan1) from within my webserver by the way..... The only difference I can see is the difference in hardware (cable = separate Juniper router with modem, ADSL = combined modem/router). Or maybe my problem lies in the IP range that my dmz has? One more thing: when I browse from my webserver via wan2 to wan1 (there' s anther webserver active on 192.168.10.2) I cannot access it. Thank you very much for having a look at my problem. Regards, Peter

[Maik]

configure the static routes with equal " Distance" but different " priorities" remove the policy routes

[Peter_IT]

Thank you, I can' t seem to set the priority in static route: internal -> dmz we need for getting files from our webserver from within our lan, is there a better way?

[rwpatterson]

Welcome to the forums. The priority configuration is a CLI based command.

 login as: rpatters
 rpatters@192.168.200.1' s password:
 Fortigate-1 $ config router static
 Fortigate-1 $ edit 12
 Fortigate-1 (12) $ set priority ?
 <integer>    please input integer value
 
 Fortigate-1 (12) $
 

The default priority is 10. Lower number has a higher priority. Valid values are from 0 (zero) to 4294967295.

[Maik]

1) You mentioned a FGT60C The Screenshot is from a FGT60 (without letter) Did you recently buy them as new? the FGT60 is running a very old firmware version where the priority setting is only available by CLI: config router static edit 1 set priority 10 next edit 2 set priority 20 next end after config router static enter " edit ?" to see the possible rule IDs. or issue the " show" command

[Peter_IT]

I' m sorry, indeed it' s FortiGate 60, not 60C. And yes, they are quit old :-) Firmware Version Fortigate-60 3.00-b0572(MR5 Patch 4) dmz -> internal is disabled by default, I should have mentioned that, sorry. It' s only for testing, I understand the risks. Thank you for warning me though! internal -> dmz is needed and causes no harm I guess. [ul]

I changed the webserver to 192.168.10.5 and indeed it' s using wan1 now. I' m confused though, why is this depending on the last number of the IP address being odd/even? Is that only for dmz?

With this IP address x.10.5, does it switch to wan2 when wan1 is down?

If it' s switching automatically when wan1 is down, do I still need the priority setting?

Can I use the distance setting so that it acts as a priority setting?

Can you explain why I should get rid of the Policy Routes?

Is it possible to install a more recent firmware on these old firewalls? [/ul] Thanks a million guys.

[Maik]

I changed the webserver to 192.168.10.5 and indeed it' s using wan1 now. I' m confused though, why is this depending on the last number of the IP address being odd/even? Is that only for dmz?

answered by ede_pfau

With this IP address x.10.5, does it switch to wan2 when wan1 is down?

should: currently when the port is physicaly down, it will switch. you have a cli option " ping-server" that indicates a port " down" when a host behind that interface cannot be reached anymore.

If it' s switching automatically when wan1 is down, do I still need the priority setting?

depends on your needs. you need the priory when you want to have all traffic over wan1 and only failover to wan2 when needed. without priority it does balance the requests over the two ports. (refer to ede_pfaus explaination)

Can I use the distance setting so that it acts as a priority setting?

no

Can you explain why I should get rid of the Policy Routes?

because you override the static routes with it. for your setup proper static routes are sufficient.

Is it possible to install a more recent firmware on these old firewalls?

most recent seems to be OS3, MR7, patch 10 from 2. Nov 2010. but i have doubts that you have a valid support contract to download the firmware. a renewal of the support contract is not possible anymore. your current firmware has been released in Dec 2007

[ede_pfau]

dmz->wan1 should work if wan2 is down (disconnected) dmz->wan1 should also work if server IP is .10.5 (odd); then dmz->wan2 should NOT work Do as Maik posted to get the routing correct. BTW, delete policy dmz->internal, it defeats the whole reason for a DMZ! (edited: dammit.i keep mixing up left and right hand as well.)

[rwpatterson]

ORIGINAL: ede_pfau BTW, delete policy internal->dmz, it defeats the whole reason for a DMZ!

I see no issue with this. The other way around does pose a huge security risk... Upon further inspection, I see the policy is indeed DMZ->internal. Big difference. That one HAS GOT TO GO... Think about it this way: Someone compromises your web server and gains access. They then have the ability to surf and destroy anything on your LAN. With this policy, you permit it. The purpose of a DMZ is to place anything out there that you are willing to lose. If those devices get hacked or compromised in any way, you rebuild them and move on. They should not be able to leave that zone at all... My DMZ devices have limited Internet access as well. You don' t want someone to hack your web server, place a mail server on it and spray SPAM all over the Internet with your IP space on it, do you? Things to think about.

[ede_pfau]

OK, I will only answer the " odd IP" question as I' ve brought it up (at a pinch right now). You configured 2 equal default routes. The FGT will do load balancing then, distributing the traffic evenly onto both WAN lines. It uses a source IP address hash for this. With only 2 routes, one is assigned the odd source addresses and one the even ones. I predicted this only to see that indeed equal cost multiple routes are in effect.