AnsweredHot!FortiGate 1240B configuration for computer connect directly on the physical interface

Author
rcslab
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/01/31 09:42:26
  • Status: offline
2018/02/20 18:53:35 (permalink) 5.2
0

FortiGate 1240B configuration for computer connect directly on the physical interface

We have some computers that are configured with public IP address, the current setup looks like top left corner of the attachment.
Because these servers are directly on the Public Internet, we would like to apply some policy to the incoming traffic, so I'm wondering if it is possible to do something like bottom left of the attachment
 

 
Currently, I have 1 server connected to port 21 with the following configuration of system interface and policy.  When I do a test ping to the server 73.xxx.xxx.100 I do see the IMCP packet come into port 27 but I don't see the ICMP to port 21.  I am guessing port 21 is not configured correctly or I'm missing some other policy?
 
config system interface
edit "port21"
set vdom "root"
set allowaccess ping
set vlanforward enable
set type physical
set description "Test Server NIC1"
set alias "WebServer"
set snmp-index 31
next
end
 
config firewall policy
edit 55
set srcintf "port27"
set dstintf "port21"
set srcaddr "all"
set dstaddr "73.xxx.xxx.100"
set action accept
set schedule "always"
set service "ALL_ICMP"
next
end

Thank you for your help.

Attached Image(s)

#1
ede_pfau
Expert Member
  • Total Posts : 5624
  • Scores: 380
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: FortiGate 1240B configuration for computer connect directly on the physical interface 2018/02/21 07:32:01 (permalink) ☼ Best Answerby rcslab 2018/02/22 07:35:18
0
As the FGT is acting as a router you cannot have the same subnet on different ports. Each port spans a broadcast domain of it's own.
Put your servers on inside ports (as depicted) but with IP addresses of a private LAN (RFC 1918). Then, create port forwarding Virtual IPs to direct traffic from WAN to those server ports, across policies. The FGT will not only proxy arp for the external address of a VIP but apply source NAT to outgoing traffic for those protected servers.
 
I wonder how you survived with your servers on a WAN switch up until today.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#2
rcslab
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/01/31 09:42:26
  • Status: offline
Re: FortiGate 1240B configuration for computer connect directly on the physical interface 2018/02/21 10:10:47 (permalink)
0
ede_pfau
As the FGT is acting as a router you cannot have the same subnet on different ports. Each port spans a broadcast domain of it's own.
Put your servers on inside ports (as depicted) but with IP addresses of a private LAN (RFC 1918). Then, create port forwarding Virtual IPs to direct traffic from WAN to those server ports, across policies. The FGT will not only proxy arp for the external address of a VIP but apply source NAT to outgoing traffic for those protected servers.
 
I wonder how you survived with your servers on a WAN switch up until today.




What I didn't put down is there is a PANW FW sitting between public Internet and the 12-ports switch, what we are interest is getting some stats/report from FGT and so would like to move them to the FGT.  So your suggestion is as follow:
 

 
Basically, reIP the servers with private IP (ie. 192.168.2.xxx), on the FGT do a IPV4_VIP (73.x.x.100 <=> 192.168.2.100, etc.) and update the policy to route traffic to 192.168.2.1 for these servers?

Attached Image(s)

#3
ede_pfau
Expert Member
  • Total Posts : 5624
  • Scores: 380
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: FortiGate 1240B configuration for computer connect directly on the physical interface 2018/02/22 07:04:21 (permalink)
0
Yes, basically.
The gateway of the private server LAN would be the port on the FGT, not a switch inbetween. Even if the 'switch' 192.168.2.1 is a PANWFW, it would run in transparent mode; even then, the next hop is the FGT.
 
The routing is done with a static route (a default route in this case). The policy will decide which sessions are allowed, and in which direction.
 
Best practice would be to avoid the range 192.168.[0-3].x - there are too many network devices with default addresses in that range. 192.168.233.0 would be fine, 172.16.11.0 and 10.11.12.0 as well.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#4
rcslab
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/01/31 09:42:26
  • Status: offline
Re: FortiGate 1240B configuration for computer connect directly on the physical interface 2018/02/22 07:44:39 (permalink)
0
ede_pfau
Yes, basically.
The gateway of the private server LAN would be the port on the FGT, not a switch in between. Even if the 'switch' 192.168.2.1 is a PANWFW, it would run in transparent mode; even then, the next hop is the FGT.
 
The routing is done with a static route (a default route in this case). The policy will decide which sessions are allowed, and in which direction.
 
Best practice would be to avoid the range 192.168.[0-3].x - there are too many network devices with default addresses in that range. 192.168.233.0 would be fine, 172.16.11.0 and 10.11.12.0 as well.



Thank you Ede!  Will set the GW on the FGT port 26 (ie. 192.168.233.1) and set as next hop from the switch where the servers are connected.
 
on the switch (I know this is not related to FGT anymore, but just to get some ideas), I assume I can have other servers on it (say they have IP of 192.168.133.x and these servers do not need Internet access at all).  Could I just create two VLANs.  VLAN 233 would be link with FGT port 26 and VLAN 133 will just be local without any Internet access.
#5
ede_pfau
Expert Member
  • Total Posts : 5624
  • Scores: 380
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: FortiGate 1240B configuration for computer connect directly on the physical interface 2018/02/22 09:25:13 (permalink)
0
Sure. Just create a VLAN port for VLAN 233 on physical port 26.
But hey, to really isolate a server group you could just put them on another port - the 1240 has got some!
Then you can control traffic from and to that group with policies. Works just as good as with a virtual port (VLAN port) but you spare yourself the extra effort to configure a VLAN on the switch.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#6
rcslab
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/01/31 09:42:26
  • Status: offline
Re: FortiGate 1240B configuration for computer connect directly on the physical interface 2018/02/22 11:35:58 (permalink)
0
ede_pfau
Sure. Just create a VLAN port for VLAN 233 on physical port 26.
But hey, to really isolate a server group you could just put them on another port - the 1240 has got some!
Then you can control traffic from and to that group with policies. Works just as good as with a virtual port (VLAN port) but you spare yourself the extra effort to configure a VLAN on the switch.


Will play around the FGT, never tried setting the interface as VLAN.  I do see there is an option to set the interface type as VLAN, 802.3ad Aggregate, Redundant Interface, Loopback, hard switch, soft switch and WiFi-SSID
#7
Jump to:
© 2018 APG vNext Commercial Version 5.5