Helpful ReplyHot![SOLVED] Fortigate Port Forwarding to several internal hosts

Author
tsypyshev.pi
New Member
  • Total Posts : 6
  • Scores: 5
  • Reward points: 0
  • Joined: 2019/02/11 19:44:50
  • Status: offline
2019/04/20 10:23:01 (permalink) 6.2
0

[SOLVED] Fortigate Port Forwarding to several internal hosts

Good day!
Does anybody use port forwarding from 1 external ip to several internal hosts?
For example, I have IP 1.1.1.1 on wan1 and want to translate port 21 to 192.168.1.2:21, port 25 to 192.168.1.3:25port 80 to 192.168.1.4:80.
First virtual IP was created without any problem. But when I try to add second VIP with my 1.1.1.1 external IP, I catch this error: "Conflicts with the External IP of another VIP".
I've created only 2 VIPs on wan1 at all - first 1.1.1.1:21 -> 192.168.1.2:21 and second 0.0.0.0:25 -> 192.168.1.2:25.
Third VIP I cannot create.
Another vendors, such as Cisco or Zyxel, can translate too much external ports to different local hosts and ports.
I'm guess, that Fortigate can do the same. But I haven't find any manual for this.
Only 1 external IP to 1 internal IP.
 
Thanks in advance for your help.
post edited by tsypyshev.pi - 2019/04/21 06:12:14
#1
Toshi Esumi
Expert Member
  • Total Posts : 1623
  • Scores: 137
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Fortigate Port Forwarding to several internal hosts 2019/04/20 21:44:25 (permalink) ☄ Helpfulby tsypyshev.pi 2019/04/21 06:04:31
#2
tsypyshev.pi
New Member
  • Total Posts : 6
  • Scores: 5
  • Reward points: 0
  • Joined: 2019/02/11 19:44:50
  • Status: offline
Re: Fortigate Port Forwarding to several internal hosts 2019/04/21 06:04:25 (permalink)
0
Hi Toshi! Thanks for your answer. I've read this article before. But every time I've stopped when I saw red highlighted text "Conflicts with the External IP of another VIP". Only today I've tried setup all external and internal IPs and when I've defined external port then this error message was disappeared. It's really discourage message.
Thank you very much for help!
#3
Thompsons
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/07/18 12:09:12
  • Status: offline
Re: Fortigate Port Forwarding to several internal hosts 2019/07/18 12:14:08 (permalink)
0
I've been running into this issue too. 
How did you get around it? It seems like a firmware update issue because if I edit some of the existing VIPs I receive this error but if I cancel out, they work fine.
 
Did you find a way to get around this issue?
#4
ede_pfau
Expert Member
  • Total Posts : 6024
  • Scores: 480
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: Fortigate Port Forwarding to several internal hosts 2019/07/21 03:27:40 (permalink)
0
No doubt multiple VIPs do work from one external to several internal IPs, provided that each uses port translation and does not use a wildcard '0.0.0.0' for the external address.
 
Tip: after creating the VIPs you need, put them into a VIP group so that one policy will suffice.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#5
Thompsons
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/07/18 12:09:12
  • Status: offline
Re: Fortigate Port Forwarding to several internal hosts 2019/07/22 09:17:07 (permalink)
0
I created a ticket with FGT support in the end and found it is an issue with the current firmware. 
From CLI,  we could create the VIP without issue but the gui would always give the error "Conflicts with the External IP of another VIP"
 
We're on v6.2.0 build0866 (GA) and hear there is new firmware coming out very soon that will fix this issue.
 
The VIP's we have all have external IP of 0.0.0.0 but we have several different WAN interfaces that we associate them with.
#6
korwinau
New Member
  • Total Posts : 3
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/07/05 03:57:35
  • Status: offline
Re: [SOLVED] Fortigate Port Forwarding to several internal hosts 2019/07/23 00:35:51 (permalink)
0
I've been trying to perform port forwarding myself for the past day or two however i'm working with a Dynamic IP on the WAN interface (everything I've read suggests leaving the extIp as 0.0.0.0).  I ran into this exact same problem however mine came from specifying mutliple VIPs in which a port is used for both TCP and UDP.  I found that the "duplicate" could be added when using the CLI which would suggest a GUI bug.
 
Try using the bellow (obviously name it whatever you need to and set the extintf to the correct name for your setup).
 
config firewall vip
edit "Second 1.1.1.1 VIP"
set extip 1.1.1.1
set extintf "wan interface"
set portforward enable
set mappedip 192.168.1.2
set extport 21
set mappedport 21
next
end
#7
ede_pfau
Expert Member
  • Total Posts : 6024
  • Scores: 480
  • Reward points: 0
  • Joined: 2004/03/09 01:20:18
  • Location: Heidelberg, Germany
  • Status: offline
Re: [SOLVED] Fortigate Port Forwarding to several internal hosts 2019/07/23 02:52:11 (permalink)
0
That's correct, you actually need to use '0.0.0.0' if the WAN IP is dynamic. Slipped on that one.
So, in the end, a GUI check routine prevents a totally valid config. This isn't the first time such a thing happens.

Ede

" Kernel panic: Aiee, killing interrupt handler!"
#8
orani
Bronze Member
  • Total Posts : 57
  • Scores: 1
  • Reward points: 0
  • Joined: 2019/07/11 12:54:18
  • Location: Athens
  • Status: offline
Re: [SOLVED] Fortigate Port Forwarding to several internal hosts 2019/07/23 06:21:48 (permalink)
0
I think you can't configure the port forward for port 80 because your fgt listens to port 80 for its web gui. If you change that port you will be able to do what you want
#9
Jump to:
© 2019 APG vNext Commercial Version 5.5