This example illustrates how to use virtual IPs to configure port forwarding on a FortiGate unit. In this example, TCP ports 80 (HTTP), 21 (FTP), and 22 (SSH) are opened, allowing remote connections to communicate with a server behind the firewall.
Watch the video
1. Creating three virtual IPs |
|
|
Go to Policy & Objects > Objects > Virtual IPs > Create New > Virtual IP. Enable Port Forwarding and add a virtual IP for TCP port 80. Label this VIP webserver-80. |
 |
|
Create a second virtual IP for TCP port 22. Label this VIP webserver-ssh. |
 |
|
Create a third a virtual IP for TCP port 21. Label this VIP webserver-ftp. |
 |
2. Adding virtual IPs to a VIP group |
|
|
Go to Policy & Objects > Objects > Virtual IPs > Create New > Virtual IP Group. Create a VIP group. Under Members, include all three virtual IPs previously created. |
 |
3. Creating a security policy |
|
|
Go to Policy & Objects > Policy > IPv4 and create a security policy allowing access to a server behind the firewall. Set Incoming Interface to your Internet-facing interface, Outgoing Interface to the interface connected to the server, and Destination Address to the VIP group. Set Service to allow HTTP, FTP, and SSH traffic. Use the appropriate Security Profiles to protect the servers. |
 |
4. Results |
|
|
To ensure that TCP port 80 is open, connect to the web server on the other side of the firewall. |
 |
|
To ensure that TCP port 22 is open, connect to the SSH server on the other side of the firewall. |
 |
|
To ensure that TCP port 21 is open, use an FTP client to connect to the FTP server on the other side of the firewall. |
 |
Download
For further reading, check out Virtual IPs in the FortiOS 5.2 Handbook.
The post Port forwarding appeared first on Fortinet Cookbook.