0

Good day all,

I am running into some trouble trying to get a device behind a fortigate 80e on the LAN to talk to a device on the WAN at one of our remote sites

Background

enter image description here

MQTT Device: 192.168.10.240

MQTT Broker: 10.29.1.224

Because of our security rules, we have to have these devices behind a Fortigate in order for them to talk to our MQTT Broker.

What I Have Tried

I created an Address for the MQTT Broker on the WAN on the Fortigate enter image description here

I created an address for the MQTT Device on the LAN on the Fortigate enter image description here

I Then created a firewall rule to allow the MQTT Device to talk to the MQTT Broker enter image description here

After all this I set the MQTT software to look for the broker as the default gateway of the fortigate at 192.168.10.1. My thinking is that it will hit this interface and then forward the traffic out of the WAN and onto the MQTT Broker, but it does not connect at all. I also look at the hit counter on the firewall rule configured on the fortigate and it says their is 0 bytes of traffic on it.

Please let me know if you can spot where I am going wrong. I have been on this for weeks to no avail.

Thank you!

2 Answers 2

1

If the MQTT Device uses the Fortigate LAN IP address as its default gateway, it will automatically try to reach any IP address outside its local, connected network by sending the request out through the Fortigate.

If the Fortigate is properly configured to allow devices on its LAN network access to the internet in general (or its WAN network basically) then you should need no additional configuration. Just have the MQTT Device use the Fortigate as its gateway/default route, and the Fortigte will perform NAT and allow the outbound connection from the MQTT Device to the MQTT Broker on its WAN network. Any reply to those connections should be allowed automatically as well to come back in through the Fortigate as long as it has been configured for general internet style access from LAN to WAN, which should basically be its default configuration.

In that kind of scenario, the MQTT Broker will see connections from the WAN interface IP address of the Fortigate, which appears to be on its local network interface and it should reply. The firewall will then forward/NAT that traffic back to the originating device, the MQTT Device. It should work just fine with a very basic configuration.

0

After all this I set the MQTT software to look for the broker as the default gateway of the fortigate at 192.168.10.1.

I'm not sure I understand - you need to set the Fortigate's LAN IP as default gateway for the LAN client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.