Helpful ReplyVirtual IP (VIP) outbound nat doesn' t work by default?

Author
Jeff Roback
Bronze Member
  • Total Posts : 35
  • Scores: 2
  • Reward points: 0
  • Joined: 2014/08/18 16:48:33
  • Status: offline
2014/08/18 18:07:15 (permalink)
0

Virtual IP (VIP) outbound nat doesn' t work by default?

The fortigate 5.x documentation states that when you create a virtual IP address (VIP)
and do NOT specify port mapping, that traffic should be translated for both inbound (dnat)
and outbound (snat) traffic.

If says: " if you leave the ' port forwarding' checkbox unchecked it is therefore mapping all
ports, it will do bi-directional NAting, so the single VIP entry will control both inbound
and outbound address translation."

Overall this seems like a very good thing for reducing the complexity of configuration
for standard internet-accessible servers.

However, we' re finding that this doesn' t seem to work unless you issue
" set nat-source-vip enable" from the CLI for every VIP (it defaults to disable).
By default, outbound traffic just falls through to the general nat pool that we have
set up for all other clients.

Is this the expected behavior? If so, I can' t see how the reference manual is correct.

If this is needed, is there a way to change the default for all VIP' s to nat-source-vip enable?
Otherwise it' s kind of a bummer to follow up each GUI based VIP with a cli command.

Here' s an example of what I see from debug in each case.
.163 is the shared pool setup for all clients, .184 is the VIP for this host. Note that
the system sees the VIP outbound IP in both cases but just seems to ignore it by
default.

Outbound initiated traffic with default settings:

id=20085 trace_id=2 func=resolve_ip_tuple_fast line=4310 msg=" vd-root received a packet(proto=6, 10.XX.XX.31:56200->64.XX.XX.216:80) from lan."
id=20085 trace_id=1 func=get_new_addr line=2593 msg=" find SNAT: IP-206.XX.XX.163(from IPPOOL), port-56199"
id=20085 trace_id=1 func=get_new_addr line=2593 msg=" find SNAT: IP-206.XX.XX.184(from IPPOOL), port-0(fixed port)"
id=20085 trace_id=1 func=__ip_session_run_tuple line=2471 msg=" SNAT 10.XX.XX.31->206.XX.XX.163:56199"

Here' s what I see after adding nat-source-vip enable:
id=20085 trace_id=173 func=resolve_ip_tuple_fast line=4310 msg=" vd-root received a packet(proto=6, 10.XX.XX.31:57646->64.XX.XX.216:80) from lan."
id=20085 trace_id=173 func=get_new_addr line=2593 msg=" find SNAT: IP-206.XX.XX.163(from IPPOOL), port-57646"
id=20085 trace_id=173 func=get_new_addr line=2593 msg=" find SNAT: IP-206.XX.XX.184(from IPPOOL), port-0(fixed port)"
id=20085 trace_id=173 func=__ip_session_run_tuple line=2471 msg=" SNAT 10.XX.XX.31->206.XX.XX.184:57646"

< Message edited by Jeff Roback -- 8/18/2014 6:16:32 PM >
#1
Istvan Takacs_FTNT
Silver Member
  • Total Posts : 118
  • Scores: 15
  • Reward points: 0
  • Joined: 2014/08/05 16:14:08
  • Location: Nowhere, OK
  • Status: offline
RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2014/08/18 19:59:28 (permalink)
0
do you have 2 different policies for all clients and another one only for 10xxx31?
I guess " all clients" use either the Fortigate external interface to getting NATed outbound or you specified a NAT address, xx.163?

The 10.xx.31 host should have a policy that NATs outbound traffic to a /32 ippool objects in the policy to 206.xxx.184.

VIP is for inbound NAT.
IPPOOL is for outbound NAT.

If you want to provide external access to your internal host, you use a VIP. You need to use the VIP in the " Destination address" field.

If you want to provide outbound access to your internal host, you enable NAT and either use the firewall external interface, or you specify an ippool address object that FGT will use to NAT it to.

Not sure about ' nat-source-vip' , but you don' t have to change the default, unless you want prevent unintended servers from using the VIP.

Here' s an example:

FGT external interface IP: 172.16.233.10
FGT external port: port1
FGT DMZ port: port2
internal web server IP: 192.168.10.10
internal web server public IP: 172.16.233.12

INBOUND:


# show firewall policy
config firewall policy
edit 3
set srcintf " port1"
set dstintf " port2"
set srcaddr " all"
set dstaddr " webserver-vip-443"
set action accept
set schedule " always"
set service " HTTPS"
set logtraffic all
next
end

OUTBOUND


config firewall policy
edit 3
set srcintf " port2"
set dstintf " port1"
set srcaddr " webserver-internal"
set dstaddr " all"
set action accept
set schedule " always"
set service " SSH"
set logtraffic all
set nat enable
set ippool enable
set poolname " webserver-ext-ippool"
next
end

# show firewall ippool
config firewall ippool
edit " webserver-ext-ippool"
set type fixed-port-range
set startip 172.16.233.12
set endip 172.16.233.12
set source-startip 192.168.10.10
set source-endip 192.168.10.10
next
end

# show firewall vip
config firewall vip
edit " webserver-vip-443"
set extip 172.16.233.12
set extintf " port1"
set portforward enable
set mappedip 192.168.10.10
set extport 443
set mappedport 8543
next
< Message edited by Istvan Takacs -- 8/18/2014 8:00:24 PM >
#2
ede_pfau
Expert Member
  • Total Posts : 6127
  • Scores: 496
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2014/08/19 02:10:55 (permalink) ☄ Helpfulby peter.wickenberg 2016/10/14 01:17:39
0
Having reread the manuals I think that the feature is working properly but your expectations differ from the implementation.

In your example, 10.x.x.31 is mapped/not mapped to the VIPs external address 206.x.x.184. The critical information lacking here is the value of the internal (" mapped to" ) address. I bet it is NOT 10.x.x.31.

The reverse mapping feature of VIPs is meant to cover the mapped-to address ONLY. Imagine a DMZ with one server to be accessible by public IP address, and other hosts in the DMZ for which no VIPs exist. Then, using the defaults, traffic from the server would be source NATted to the " mapped-to" address in the VIP but other traffic would not, using the interface IP or an IP pool instead.

Otherwise, traffic from all hosts would seem to come from the one server that is made public by a VIP. This would rather be surprising. The main disadvantage of having a VIP cover all source addresses of its interface automatically would be that you cannot undo this NAT. If you intend to differentiate between traffic from the public server and that of other hosts you would not be able to deselect such a source NAT.

So, in short: hosts explicitely specified in a VIP are automatically source NATted by the VIP. Other traffic is not NATted unless you configure source NAT via IP pool.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#3
Jeff Roback
Bronze Member
  • Total Posts : 35
  • Scores: 2
  • Reward points: 0
  • Joined: 2014/08/18 16:48:33
  • Status: offline
RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2014/08/19 16:16:44 (permalink)
0
Thanks for take a look at this guys.

@ede_pfau

Re : " In your example, 10.x.x.31 is mapped/not mapped to the VIPs external address 206.x.x.184. The critical information lacking here is the value of the internal (" mapped to" ) address. I bet it is NOT 10.x.x.31."

Actually that is exactly what I' m doing. Here' s the configuration.


config firewall vip
edit " Test Server"
set extip 206.XX.XX.184
set extintf " wan1"
set nat-source-vip enable
set mappedip " 10.5.XX.31-10.5.XX.31"
next
End

edit " WAN1 Globl PAT Address IPP"
set startip 206.XX.XX.163
set endip 206.XX.XX.163
next

edit 37
set srcintf " lan"
set dstintf " wan1"
set srcaddr " all"
set dstaddr " all"
set action accept
set schedule " always"
set service " ALL"
set logtraffic all
set nat enable
set ippool enable
set poolname " WAN1 Globl PAT Address IPP"
next
end


" So, in short: hosts explicitly specified in a VIP are automatically source NATted by the VIP. Other traffic is not NATted unless you configure source NAT via IP pool. "

Yes, this is exactly what I' m trying to accomplish: I want to have internet facing servers to each have a single public ip for inbound and outbound traffic. Then I want to have all other devices (User worksatations, non public facing servers, etc) use a common NAT address that isn' t the same as the firewall interface IP (It' s an old habit, but having the interface IP used for outbound PAT always seems to cause problems with IPSEC tunnels).

So based upon the documentation, it seems like I can do this with just the VIP, which saves the additional configuration of creating an IPP and a policy and keeping all of that in sync. The configuration above works perfectly once I add in the " Set nat-source-vip enable" , but in the default configuration with " Set nat-source-vip disable" it doesn' t. So it seems like either the documentation is wrong, or there' s a bug in the feature.

Ultimately if there was a way to set " Nat-Source-vip enable" to the default on all VIP' s I' d be happy :-)

@ Istvan Takacs

I am aware of the option of using VIP for inbound nat and IPPOOL for outbound nat. But in reading through the documentation it occurred to me that if I' m planning on using the same IP for inbound and outboud nat, it would be much cleaner to have just a single VIP for the server instead of having to create an IPPOOL and a policy separately for each inbound server… cuts the config a lot. Plus it' s less objects to keep track of and keep in sync as things change over time.

Thanks!
#4
ede_pfau
Expert Member
  • Total Posts : 6127
  • Scores: 496
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2014/08/20 03:20:50 (permalink)
0
You' re totally right. With this previously missing piece of information I would call that a bug in the VIP implementation. Rather, the effect of " nat-source-vip" is reversed, the default as " disabled" seems OK.

If you care enough please open a ticket with TAC to have this verified and if so, corrected in a future bug fix.

And good to know, thanks for posting your problem. This should affect other as well who might be wondering what is going on with these VIPs...

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#5
netmin
Gold Member
  • Total Posts : 209
  • Scores: 22
  • Reward points: 0
  • Joined: 2013/11/28 13:49:12
  • Location: NE, Germany
  • Status: offline
RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2014/08/20 04:53:26 (permalink)
0
Are you using any inbound allow/deny policy to your VIPs? The KB article http://kb.fortinet.com/kb/viewContent.do?externalId=FD31893 mentions that for pure outbound 1:1 NAT an inbound policy is required to activate it or the interface IP is used (or likely the ippool as in your case).
#6
ede_pfau
Expert Member
  • Total Posts : 6127
  • Scores: 496
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2014/08/20 05:26:59 (permalink)
0
Thanks for the hint. The article confirms that reverse (source) NAT to the VIP' s external IP address is done automatically, as long as the VIP is activated as a destination address object.

The real usefulness of this 1:1 NAT would be more obvious if the VIPs were not consecutive in a range.

Frankly, the more I read that is should " just work" the more I think it' s a bug.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#7
netmin
Gold Member
  • Total Posts : 209
  • Scores: 22
  • Reward points: 0
  • Joined: 2013/11/28 13:49:12
  • Location: NE, Germany
  • Status: offline
RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2014/08/20 05:37:04 (permalink)
0
I only got the impression that Jeffs FGT is just being set up (or planned) and the VIPs might not yet have an inbound policy associated with them.
#8
Jeff Roback
Bronze Member
  • Total Posts : 35
  • Scores: 2
  • Reward points: 0
  • Joined: 2014/08/18 16:48:33
  • Status: offline
RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2014/08/22 10:37:48 (permalink)
0
@ede_pfau
Thanks for confirming my thoughts on this. I did originally open up a case with TAC and they insisted that it doesn' t work this way and I should just use a Pool for outbound....
but I think the person that added this feature sure intended for it to work this way :-)

Even the examples in the documentation for video conferencing, for example, are going
to break if you follow the directions because without nat-source-vip the outbound traffic
won' t nat to the same ip as inbound.

@netmin

yes there is an inbound policy that allows the traffic in (I just left that out to keep the configs small. Always a tough choice what to include or exclude.)
I think the thing that confirms this is all setup correctly is the nat-source-vip behavior. Without any additional changes, when in the default state, the outbound traffic uses the shared Ip address. once I change nat-source-vip, it immediately changes outbound traffic to begin using the VIP address.

This is one of several FGT' s were just bringing live. We' re in the process of transitioning from sonicwalls at several customer sites. So far I' m really loving the fortigates, and I' m trying to develop overall best practices for our team going forward.


#9
Jeff Roback
Bronze Member
  • Total Posts : 35
  • Scores: 2
  • Reward points: 0
  • Joined: 2014/08/18 16:48:33
  • Status: offline
RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2014/08/28 13:56:37 (permalink)
0
So I opened up a case w/ support and after they looked at it they said " Oh, you' re using a IPP on the interface. It won' t work then. Once you use one IPP then bidirectional VIP' s don' t work.

Which again strikes me as a bug or a documentation error.

So it seems to me that they should really update the documentation to tell you that VIP' s only work bidirectionally if set nat-source-vip enable is put in. Or ideally they' d set the default state of set nat-source-vip to enable for new VIP' s and/or expose that flag in the GUI.

This is a really great feature that can dramatically simply common configurations, so I' ve got to think the team that put it there intended for it to be used this way, which is why it' s covered so clearly in the documentation and KB....

But I' m not sure I can get tech support to take it much further :-(

Jeff
#10
MBR
Bronze Member
  • Total Posts : 55
  • Scores: 2
  • Reward points: 0
  • Joined: 2014/06/20 04:13:26
  • Status: offline
RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2014/09/19 00:16:55 (permalink)
0
Hi Jeff,

I ran into the same issue.
I solved this by creating a specific outbound policy for the server behind the VIP and just enabled NAT on it.
The FGT will use the VIP address for outbound traffic.
I just had to make sure this policy is above a generic outbound policy which uses an IPPOOL because otherwise it would use the IP from the pool.

But the solution to use the ' nat-source-vip' setting is better.

We migrated over from Juniper ScreenOS based firewalls in which VIPs are automatically bi-directional.

i hope Fortinet would add this setting to the GUI some day.

Thanks for sharing.


- MBR -
NSE1, NSE2, NSE3
FGT60D/E, FWF60D/E, FGT200D
#11
Christopher McMullan_FTNT
Platinum Member
  • Total Posts : 415
  • Scores: 36
  • Reward points: 0
  • Joined: 2014/09/08 08:00:33
  • Status: offline
RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2014/09/19 05:35:11 (permalink)
0
Would someone volunteer to open a ticket to request this as a New Feature Request?

With major releases containing new features, and patches reserved for bugs, this could make it to 5.4 if there is a strong enough push for it.

Regards,
Chris McMullan
Fortinet Ottawa
#12
VicAndr
Gold Member
  • Total Posts : 151
  • Scores: 2
  • Reward points: 0
  • Joined: 2004/04/12 18:17:00
  • Location: Toronto, Canada
  • Status: offline
RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2014/09/24 12:37:33 (permalink)
0
I " arrived" to this topic from another one where I had overlapping questions (thank you, ede ).

To Jeff Roback:
Thank you for bringing this subject to our attention! I' ve been using outbound firewall policies combined with IP pools to define servers' public IP addresses for outgoing traffic for years but didn' t know that there was a simpler and " cleaner" alternative to achieve reverse (source) IP NAT-ting through the very same VIPs. And reading through the posts I realized that I am far from being alone in this. By default it is disabled but could be enabled for a particular VIP with a single " set nat-source-vip enable" CLI statement.

I don' t think that a VIP source NAT should be enabled by default - for majority of your publicly available servers you do not really need it. But it is great to know that you could easily turn SNAT on for those servers which require that. I agree with you and others though that Fortinet' s documentation misrepresents default status of VIP SNAT.

To Christopher McMullan_FTNT:
There is no need " to open a ticket to request this as a New Feature Request" . VIP SNAT has been readily available in FortiOS at least from v3.0.X. Some of us simply overlooked and didn' t use that feature.

It would be nice though if there was a global option to change the default status of VIP SNAT to make " everyone happy" : those who are OK with default SNAT disabled - would keep it that way, and those who want it otherwise were able to change it.

To MBR:
i hope Fortinet would add this setting to the GUI some day.

Yes, it would be nice to have a checkbox in GUI to enable/disable SNAT when you configure a VIP. But again, CLI has so many configuration options for every single object (which is awesome!) so it becomes a real challenge for FortiOS developers - what to include and what not into GUI while keeping it functional, yet tidy and uncluttered.

I love this TMX1' s quote from Features that you would like to see topic:


I would like to see less " Features" and more of fixing the existing bugs!

OH and stop changing/renaming stuff around for no reason.

< Message edited by VicAndr -- 9/24/2014 2:32:07 PM >
#13
peter.wickenberg
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/08/11 04:34:20
  • Status: offline
Re: RE: Virtual IP (VIP) outbound nat doesn' t work by default? 2016/10/14 01:16:57 (permalink)
0
Hi
 
Thanks for the explainations, the solution was very simple when I understood my misunderstanding that was the reason for this not working as expected.
 
By binding the VIP to the guest network interface it started to work just as expected without disturbing the traffic from the printer in the administrative network out to the outside, so now everything is working just peachy. 
 
Best regards
Peter
#14
Jump to:
© 2019 APG vNext Commercial Version 5.5