0

On a Fortigate firewall, one can configure Destination NAT using the DNAT & Virtual IPs section of the GUI, or the config firewall vip section of the CLI.

When you create a DNAT object using either method, you must define the object's Interface (extintf), and can optionally define its Source Interface Filter (srcintf-filter). The Interface can be set to a single interface name (or the value any), while the Source Interface Filter can be set to zero, one or more interface names.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-VIP-difference-in-srcintf-filter-and/ta-p/259694 is intended to describe the difference between these two settings, but I am having trouble reasoning about what it is saying. One statement that article makes is:

extintf will not bind the VIP to the specific interface. That means that the VIP shown as an example above [a sample with extintf = wan1 and no srcintf-filter] will accept connections from each and every interface.

So what is extintf actually defining? (I am fairly certain it is not the interface on which to expect the target/real device -- that is determined by routing.)

Can anyone with experience with these devices clarify what the difference is in a practical sense? In particular, what changes in the translation/forwarding logic and/or policy requirements in the following hypothetical scenarios:

  1. extintf and srcintf-filter set to the same single value, ifA
  2. extintf set to ifA and srcintf-filter set to ifB
  3. extintf set to ifA and srcintf-filter set to multi-value ifB ifC
  4. extintf set to ifA and srcintf-filter set to multi-value ifA ifB ifC
  5. extintf set tp any

...?


For a more-tangible example, I have a lab Fortigate with wan and lan interfaces. Two VLANs are defined on the lan interface, creating vlanA and vlanB interfaces. Two IPSec VPNs tunnel between the wan interface and two external devices, creating vpnA and vpnB interfaces.

The tunnels establish correctly and the Fortigate recieves packets from the remote subnets (verified by packet-capture). The Fortigate's local encryption domain for both tunnels is 192.0.2.0/28, but this is not a real subnet in either vlanA or vlanB.

I have a DNAT object dnatA which is intended to direct a remote user coming in via vpnA and requesting 192.0.2.1 to a device with a real location on vlanA. I have a second DNAT object dnatB which is similarly intended to direct a remote user requesting 192.0.2.1 via vpnB to a real device on vlanB.

This works exactly as intended, when I use the following settings:

  1. dnatA having extintf = vpnA and srcintf-filter = vpnA (i.e. matching values)
  2. dnatB having extintf = vpnB and srcintf-filter = vpnB (i.e. matching values)
  3. A Policy entry permitting communication between srcintf vpnA and dstintf vlanA
  4. A Policy entry permitting communication between srcintf vpnB and dstintf vlanB

It does not appear to work with:

  1. dnatA having extintf = any and srcintf-filter = vpnA
  2. dnatB having extintf = any and srcintf-filter = vpnB (why is vpnA not considered one of any?)

Nor does it appear to work with:

  1. dnatA having extintf = vlanA and srcintf-filter = vpnA
  2. dnatB having extintf = vlanB and srcintf-filter = vpnB (why not, if "extintf will not bind the VIP to the specific interface"?)

If I were to subsequently require users of new remote tunnel vpnA2 to also access the device in vlanA, I might consider naiively consider adding vpnA2 to the srcintf-filter of dnatA (since srcintf-filter can accept multiple values). However, what then is the correct logical value for extintf?

Given my example scenario sees nothing forwarding when extintf value is not the same as the srcintf-filter value, what is a viable reason for having mismatching extinf/srcintf-filter values?

(Lab device is currently on FortiOS 7.0, but I don't think the version is the deciding factor here...)

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.