Helpful ReplyHot!Fortigate 100E 6.4.1

Author
mikefoulos
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/07/27 23:51:36
  • Status: offline
2020/07/28 23:14:26 (permalink)
0

Fortigate 100E 6.4.1

Fortigate 100E 6.4.1

Hello guys,

I am new at forum as well at Fortinet Firewall.

I am working in a company at Greece. We have Fortigate 100E with 6.4.1. Before i mention my problem let me explain you my topology.

We have 2 ISP on WAN 1 and WAN 2. On WAN 1 which connected to ISP1 we have a block of 16 static IPS and on WAN 2 he have ISP 2 with DSL connection, ISP modem/router in Bridge Mode and in WAN 2 on Fortigate PPPOE ( Username and password) with static IP.

On my Local Network i have my LOCAL LAN ( 192.168.230.0/24) and i have created 2 VLANS ( VLAN 100, 192.168.5.1/24 and VLAN 200, 192.168.8.1/24) under my LOCAL LAN. In the VLANS i have Servers ( Mail Server, FTP Server, Web Server, Web app Server etc)

My Goal is to achieve traffic from LOCAL LAN and VLAN 100 go through WAN1 ( I have setup in my WAN 1 secondary IPs so i can bind every server with one static IP ( one to one NAT) ) and i havee setup firewall policies. And VLAN 200 traffic go through WAN 2 ( PPPOE with Static) and bind two servers with static IP ( In this VLAN i have one Web Server and one MSQL Server, so its just a simple port forwading and policies to firewall).

Firstly i tried this step by step. First step i add my WAN1 with static IP (1.1.1.2/255.255.255.240) with secondary IPS 1.1.1.3-4-5-6. Static route to gateway 1.1.1.1 distance 10 priority 0.
 
Firewall Policy LOCAL LAN to WAN1 source LOCAL LAN Subnet destination all service all, nat enable. Everything is working, i have internet access. Second Firewall Policy VLAN 100 to WAN 1 source: VLAN 100 Subnet to WAN 1 Destination: all service: all, nat enable. Everything is working, i have internet access.
 
Third step VIRTUAL IP. ( In VLAN 100 i have 2 web servers, email server and ftp server). So i created 4 VIPS.
1) Name: WEBSERVER 1 Outgoing Interface: WAN1 External IP: 1.1.1.3 Inside IP: 192.168.5.11
2) Name: WEB Server 2  Outgoing Interface: WAN1 External IP: 1.1.1.4 Inside IP: 192.168.5.12
etc.
 
Fourth Step i create Firewall Policies so can i access the servers outside Inside Interface: WAN 1 Outside Interface: VLAN 100 source: all Destination: WEBSERVER 1 services HTTP, HTTPS etc. and of course NAT Disable.
 
I can access all my servers from outside. Everything great.
 
Then i add firewall policies,To access my VLAN from my LOCAL LAN. Everything ok. Until now all perfect.
 
1) LOCAL LAN->VLAN 100
2) VLAN 100 -> LOCAL LAN
 
 
After a few days i add the WAN2. ISP Modem in Bridge Mode and in Fortigate WAN2 PPPoE ( Username and password) connection ok. Static IP ok.
 
VIrtual IP
1) Name: WEBSERVER 3 Outgoing Interface: WAN2 External IP: 2.2.2.2 Inside IP: 192.168.8.10 Port Forward:8080 in all filelds.
2)Name: SQLSERVER 1 Outgoing Interface: WAN2 External IP: 2.2.2.2 Inside IP: 192.168.8.11 Port Forward:1433 all fields.
 
I create Firewall Policies so can i access the servers outside Inside Interface: WAN 2 Outside Interface: VLAN 200 source: all Destination: WEBSERVER 3 services HTTP, HTTPS etc. and of course NAT Disable. And the same for SQL Server.
 
And now the problem starts:
 
When WAN 2 is up ,traffic from LOCAL LAN and VLAN 100 doesnt go out from WAN 1. So i check WAN 2 and i saw distance 5. I change it to 10 and i add Policy Route (Incoming Interface: VLAN 200 Source Address : VLAN200 Subnet Destination: 0.0.0.0/0 or ALL ( i tried both) Outgoing Interface: WAN 2 Gateway: 0.0.0.0/0 ) BOOM ok VLAN 200 going traffic out from WAN2. But WAN 1 still Down. Second Policy Route ( Incoming Interface: LOCAL LAN, VLAN100 Source Address:LOCAL LAN, VLAN 100 Subnet Destination Address: 0.0.0.0/0 or ALL ( i tried both) Outgoing Interface: WAN1 Gateway:1.1.1.1) BOOM traffic from LOCAL LAN and VLAN 100foing out WAN 1.
 
But the problem is that i can access from LOCAL LAN the VLANS. I create Firewall Policies.
1) LOCAL LAN->VLAN 100
2) VLAN 100 -> LOCAL LAN
3) LOCAL LAN->VLAN 200
4) VLAN 200-> LOCAL LAN
5) VLAN 200-> VLAN 100
6)VLAN 100-> VLAN 200.
 
Nothing happened. I cant even ping the servers ( But i can ping gateways 192.168.5.1, 192.168.8.1). And beside all these i cant access my websites through public IP or private IPs ( I think this is Hairpin NAT something like this). But from different network ( From my Home computer or my mobile through 4G)  i can access the websites without problem.
 
* I have Dlink Switch ( Default VLAN,VLAN 100,VLAN 200) port 1 trunk.
 
So to sum up.
                                                            WHY THIS IS HAPPENED?????
1) Why i cant access my servers ( Remote Desktop,ping)?
2) How can i set up Hairpin NAT?
 
Is it something wrong with my WAN setup. Please help me i am going to lose my mind.
#1
sw2090
Expert Member
  • Total Posts : 712
  • Scores: 50
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: Fortigate 100E 6.4.1 2020/07/28 23:42:06 (permalink)
0
Maybe the most easiest way could be to enable sd-wan and put your wans in there and then create some sd-wan rules for your traffic. 
 
#2
mikefoulos
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/07/27 23:51:36
  • Status: offline
Re: Fortigate 100E 6.4.1 2020/07/29 00:08:33 (permalink)
0
Ok, but why when i enable Policy Routes i lose connection with my VLANS?
 
Why i cant access my server with the FQDN or private IP?
#3
mikefoulos
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/07/27 23:51:36
  • Status: offline
Re: Fortigate 100E 6.4.1 2020/07/29 00:46:29 (permalink)
0
And is the o guide how to config SD-WAN for manage traffic through specific WAN. If i tried it and succeed and rebuild the Firewall Policies and VIP it will be everything ok.
#4
sw2090
Expert Member
  • Total Posts : 712
  • Scores: 50
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: Fortigate 100E 6.4.1 2020/07/29 00:47:06 (permalink)
0
if you create sd-wan rules like I suggested you won't loose anything.
 
#5
sw2090
Expert Member
  • Total Posts : 712
  • Scores: 50
  • Reward points: 0
  • Joined: 2017/06/14 01:27:25
  • Location: Regensburg
  • Status: offline
Re: Fortigate 100E 6.4.1 2020/07/29 00:51:01 (permalink)
0
well if you enable sd-wan and put your wans in there (and I recommend to also creade sla performance check to enable sd-wan to check if a wan is still there or not) it will do load blanacing accoarding to the algorithm set in the sd-wan rule #0. 
If there is other sd-wan rules before and the traffc matches those then it will use those.
 
So if you set a sd-wan rule stating that all traffic coming from vlan100 interface/subnet that wants to go to the internet (destination any / service any) should go over wan1 and put that before #0. All traffic coming from vlan100 interface/subnet will hit the internet via wan1. All other traffic doesn't match the rule and will hit #0 (Loadbalancing) then.
 
#6
mikefoulos
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/07/27 23:51:36
  • Status: offline
Re: Fortigate 100E 6.4.1 2020/07/29 07:56:58 (permalink)
0
Ok, but why when i enable Policy Routes i lose connection with my VLANS?
 
Why i cant access my server with the FQDN or private IP?
#7
Alexis G
Silver Member
  • Total Posts : 86
  • Scores: 10
  • Reward points: 0
  • Joined: 2017/06/20 05:05:23
  • Status: offline
Re: Fortigate 100E 6.4.1 2020/07/30 06:44:58 (permalink)
0
I m sorry . but:
1. 6.4.1 is not considered a production release .
2. To my understanding you need professional services over this project.
I mean that your are not asking for just a detail over a configuration, you are trying to deploy a new IT System and do not know how to use Fortigate , trying to build it over a forum ??
Sorry
 
#8
brycemd
Silver Member
  • Total Posts : 105
  • Scores: 6
  • Reward points: 0
  • Joined: 2016/12/03 11:24:30
  • Status: online
Re: Fortigate 100E 6.4.1 2020/07/30 06:50:30 (permalink) ☄ Helpfulby Andy Bailey 2020/07/30 07:18:36
0
Policy routes take priority over normal routes.
 
So in your description you set source as the vlan and destination as 0.0.0.0 and selected a WAN interface - This means that anything coming from the vlan will be directed out the WAN interface rather than whatever interface it normally would have went.
 
You have to be careful with policy routes and be as specific as possible. Or, create another policy route above it that has source as the internal subnets and destination as internal subnets and tell it to 'stop policy routes' which it will then fallback on regular routes
post edited by brycemd - 2020/07/30 06:55:29
#9
Andy Bailey
Silver Member
  • Total Posts : 81
  • Scores: 12
  • Reward points: 0
  • Joined: 2016/06/27 11:21:22
  • Status: offline
Re: Fortigate 100E 6.4.1 2020/07/30 07:18:29 (permalink)
0
hi mikefoulos
 
I agree with what brycemd says above.
 
I also got caught recently by policy routes- in my case I re-routed by inbound traffic accidentally by using a "generic" route (think: any to SD-WAN).
 
You do not actually need policy routes for SD-WAN. They are not a requirement (as Tech Support confirmed to me). You can use them to steer traffic if you need to- but there are other approaches with SD-WAN.
 
Have you checked:-
 
https://docs.fortinet.com/sdwan
 
The documentation is pretty good really.
 
Kind Regards,
 
 
Andy.
 
 
 
#10
mikefoulos
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/07/27 23:51:36
  • Status: offline
Re: Fortigate 100E 6.4.1 2020/07/30 08:09:25 (permalink)
0
Alexis G.
 
I have made this build with Watchguard at least 4 times and i have never problem.
 
#11
mikefoulos
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/07/27 23:51:36
  • Status: offline
Re: Fortigate 100E 6.4.1 2020/07/30 08:17:33 (permalink)
0
brycemd
 
I will try it fisrt with my current config.
 
So i ll place above my current Policy routes , policies from my VLANS to LOCAL LAN and my LOCAL LAN to VLANS wit stop policy route and the i ll set traffic from interfaces to the specific WAN.
#12
mikefoulos
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/07/27 23:51:36
  • Status: offline
Re: Fortigate 100E 6.4.1 2020/08/03 08:06:28 (permalink)
0
Ok guys,
 
I have succeed about 80%.
 
Now the problem is i cant reach my Webserver that is in VLAN 200 and goes out through WAN2. I can ping the server ,i am connecting remotely but i can open webpage through external IP or Internal.
 
From my mobile or other network i can reach it. Any thoughts??
#13
poundy
Bronze Member
  • Total Posts : 41
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/06/13 20:58:45
  • Status: offline
Re: Fortigate 100E 6.4.1 2020/08/03 17:30:47 (permalink)
0
debug flow trace :-) 
#14
Jump to:
© 2020 APG vNext Commercial Version 5.5