Virtual IP inbound NAT using wrong IP going outbound

Author
ChEd
New Member
  • Total Posts : 20
  • Scores: 0
  • Reward points: 0
  • Joined: 2009/10/12 05:56:24
  • Status: offline
2013/07/18 06:55:28 (permalink)
0

Virtual IP inbound NAT using wrong IP going outbound

Hello All,

Following a thread I posted recently related to routing the same firewall is giving me problems with a NAT (fortigate 200B, running v4.0,build0639,120906 (MR3 Patch 10)) I am struggling to find a reason why a server with inbound NAT configured using a VIP (for email to flow inbound) is not going out on the same interface it came in on.

My understanding is that if I NAT something inbound then it should use the same external IP on the VIP to go outbound?

So if I have set it to use a specific external IP coming inbound on port 12 it should show that IP as its IP if it makes an outbound connection?

The email server makes outbound connections to mimecast for sending mail and its locked to a specific IP.

I have seen this work fine on other fortigates but this one is showing it as using port 9 going out which shouldn' t happen with a server running on a VIP right?

The weird thing is its still accepting connections inbound for RDP/email etc. just fine but I had to use a policy route to force it to use the correct interface to go out to mimecast and when I do this the IP when you telnet the mimecast servers is the correct one that I have set as the external IP on the VIP.

Here is the setup:

port12 -> internal - this has the VIP on it but when the server goes outbound its using port 9?!

The firewall in question does have multiple routes out to the internet but I am getting reports that the internet speed is not great for users but its just doing source IP based ECMP so perhaps its just hitting port 9 a lot since this is the first route to the internet in its routing table?

< Message edited by ChEd -- 7/18/2013 6:56:10 AM >
#1
micahawitt
Silver Member
  • Total Posts : 78
  • Scores: 2
  • Reward points: 0
  • Joined: 2013/05/07 10:33:51
  • Status: offline
RE: Virtual IP inbound NAT using wrong IP going outbound 2013/07/18 07:54:52 (permalink)
0
Ched, if im reading this right, lets say you have a block of ips. 1.1.1.1-1.1.1.5.

your saying that if you have an inbound vip of 1.1.1.2 to point to something internal, it should go out 1.1.1.2, instead its going out 1.1.1.1 (default outbound for argument sake.)

Typically what i do, is in the IP pool section create your static outbounds, for example

1.1.1.1 = outbound clients
1.1.1.2 = outbound fortimail
1.1.1.3 = outbound x

your default for all traffic i assume is port 9.

to change this, make a new policy for your inbound to go outbound.

so, if 1.2 is inbound, make a firewall object for that one internal vip you have. Then make your policy...

source internal
firewall object
port 12
all
nat, dynamic ip pool, and then choose your outbound fortimail.

that should fix your issue, attached i have a pic of mine to help



Attached Image(s)

#2
ChEd
New Member
  • Total Posts : 20
  • Scores: 0
  • Reward points: 0
  • Joined: 2009/10/12 05:56:24
  • Status: offline
RE: Virtual IP inbound NAT using wrong IP going outbound 2013/07/18 08:12:43 (permalink)
0
Thanks micahawitt.

Yes you understood what I was trying to say.

I don' t normally use IP pools when choosing NAT on an outbound policy, normally I leave it set to use destination interface address.

I did actually have a firewall policy like you described set (but using destination interface address on the NAT setting) but it was preventing some machines on the LAN accessing the internet that was revealed when I did a packet trace from the CLI.

It probably relates to the fact this thing has 8 routes out to the internet and port 9 is the first entry in the static routing table, hmmm.
#3
micahawitt
Silver Member
  • Total Posts : 78
  • Scores: 2
  • Reward points: 0
  • Joined: 2013/05/07 10:33:51
  • Status: offline
RE: Virtual IP inbound NAT using wrong IP going outbound 2013/07/18 08:33:25 (permalink)
0
well...

if you move the policy higher up in the list for your single outbound nat with ip pool, your routing table shouldnt affect to much for your default clients. Anything default for clients, make sure it is that last one possible.



#4
ChEd
New Member
  • Total Posts : 20
  • Scores: 0
  • Reward points: 0
  • Joined: 2009/10/12 05:56:24
  • Status: offline
RE: Virtual IP inbound NAT using wrong IP going outbound 2013/07/18 08:44:40 (permalink)
0
I did try to move the policy up but it refused because I am using a zone to group some interface mode IPsec tunnels together.

It comes up with this:

" Moving a policy from one interface/zone pair to a different interface/zone pair is not permitted."

If I wanted to move it up would I have to take out the IPsec tunnels in the zone that are terminated on the port that relates to the policy that I am trying to move?
#5
micahawitt
Silver Member
  • Total Posts : 78
  • Scores: 2
  • Reward points: 0
  • Joined: 2013/05/07 10:33:51
  • Status: offline
RE: Virtual IP inbound NAT using wrong IP going outbound 2013/07/18 08:50:08 (permalink)
0
Ahhhh

so, when i say move up, i mean look at the actual ID of the policy. You might have to add that column in to see. Yea moving from one zone to another wont work.

so with in then zones of your port to port policies, example, port12 --> wan1, and for all zones for that matter

typically i do vpn(ssl and ipsec) first in order, then your specific vips outbound, then lastly client stuff (least important.)

but with in the zones, again, make sure you can see that ID column, and move that vip to and id previous to the last id. i got this messed up when i first started on fortigates..


Attached Image(s)

#6
ChEd
New Member
  • Total Posts : 20
  • Scores: 0
  • Reward points: 0
  • Joined: 2009/10/12 05:56:24
  • Status: offline
RE: Virtual IP inbound NAT using wrong IP going outbound 2013/07/18 09:08:52 (permalink)
0
Thanks again but I do have the ID column shown, I remember going from the older green interface to the new look and wondered where the ID had gone to :)

Perhaps if I try to shuffle the VPN zone around it might then let me move the firewall policies that relate to outbound internet access?
#7
micahawitt
Silver Member
  • Total Posts : 78
  • Scores: 2
  • Reward points: 0
  • Joined: 2013/05/07 10:33:51
  • Status: offline
RE: Virtual IP inbound NAT using wrong IP going outbound 2013/07/18 09:17:57 (permalink)
0
if you are within a zone, say port12 to wan1, then you should be able to shuffle them around.

If not, then i would leave tunnels as they are, then you would probably have to delete the non tunnels, and recreate them as needed.

it really depends on how it is setup and the overall goal. Sometimes i have put myself in a pickle with that and realized i had to recreate all my policies becuase of poor planning on my part on how i wanted things to flow.

as i think about this a little more clearly, the only thing that should change is the fact that you added an ip pool to your one policy. as long as your default outgoing port, port9 it sounds like houses all your external ips, then you should be ok. the move the id up one from the default outgoing and add the ippool outbound nat.

otherwise, delete that one policy, recreate it on port12 to wan1, set the outbound ip pool and should be good to go. then all the other policies can stay as is.
#8
ChEd
New Member
  • Total Posts : 20
  • Scores: 0
  • Reward points: 0
  • Joined: 2009/10/12 05:56:24
  • Status: offline
RE: Virtual IP inbound NAT using wrong IP going outbound 2013/07/18 09:29:26 (permalink)
0
It' s looking like I might have to re-create some policies on this thing to try to get it to behave how I need it to.

I inherited this config (I converted the config from a 200A to this 200B) and its not ideal now so I might try to shape the interface that it uses for internet traffic using priorities on the static routes out to the internet.

Thanks for your advice :)
#9
micahawitt
Silver Member
  • Total Posts : 78
  • Scores: 2
  • Reward points: 0
  • Joined: 2013/05/07 10:33:51
  • Status: offline
RE: Virtual IP inbound NAT using wrong IP going outbound 2013/07/18 09:30:43 (permalink)
0
NPS!!

Good luck!!
#10
Richard Bartlett
New Member
  • Total Posts : 17
  • Scores: 1
  • Reward points: 0
  • Joined: 2004/11/16 05:33:04
  • Status: offline
RE: Virtual IP inbound NAT using wrong IP going outbound 2013/08/02 03:26:39 (permalink)
0
My understanding is that if I NAT something inbound then it should use the same external IP on the VIP to go outbound?


This is an incorrect preconception.

What interface and what IP your server has for flows (sessions) it initiates itself is controlled by the routeing/routing table.

The IP you present, per interface is most dominantly impacted by whether the Virtual-IP you' ve configured is shared (by specifying ports or port ranges) or dedicated (1:1 NAT). IP Pools can give you a certain internet identity but this isn' t an ideal configuration if you mention your Virtual-IP in your Virtual-IP-Pool. If you want your inbound VIP to be used to present your public IP identity on outbound streams then configuring your VIP as a 1:1 NAT is best. Then simply don' t allow Internet->DMZ connectivity beyond what you want to expose for inbound flows from the general public. Of course you' ll burn more public IPs this way but you may regret trying to mix SNAT (outbound flows using a pool) with DNAT (inbound flows using VirtualIP) where the public IP is the same address. In FortiOS it seems consistently bad practice to try this.

Static routes (be they enhanced or not by the features of ECMP with its optional biasing (weighting, spillover) and PBR) dictate whether you' ll initiate a flow from your server over one line or another.

It would be nice if PBR was another bias option that could have multiple entries to steer the ECMP/load-balance engine but adding features like this would probably take some convincing for the Fortinet engineers. Most routeing/forwarding features we have here seem to be present only when they also have some representation in Linux/BSD or Windows in order to appear in FortiOS. There are some exceptions where commercial load balancer philosophies/paradigms have been made equivalent in FortiOS and implemented quite well. Nevertheless, configuration of forwarding to the utmost extremes of flexibility isn' t where these platforms are at currently. For example, being able to control how the forwarding cache ages out isn' t in the current bag of tools.
< Message edited by Richard Bartlett -- 8/2/2013 3:29:30 AM >
#11
Jump to:
© 2019 APG vNext Commercial Version 5.5