Configuring a VIP for IPv4
In the Network section:
- If an IPv4 type of Virtual IP, select the Interface setting.
Using the drop down menu for the Interface Field, choose the incoming interface for the traffic.
The IPv4 VIP Type is the only one that uses this field. This is a legacy function from previous versions so that they can be upgraded without complicated reconfiguration. The External IP address, which is a required field, tells the unit which interface to use so it is perfectly acceptable to choose "any" as the interface. In some configurations, if the Interface field is not set to "any" the Virtual IP object will not one of the displayed options when choosing a destination address.
- Configure the External IP Address/Range.
There are two fields. If there is a single IP address, use that address in both fields. This will be the address on the outside of the network that is usually the public address of the server. The format of the address will depend on the VIP Type option that was selected.
- Configure the Mapped IP Address/Range. This will be the address that the traffic is being directed to.
There are two fields. If there is a single IP address, use that address in both fields. The format of the address will depend on the VIP Type option that was selected.
In the Optional Filters
- Disable/Enable the Optional Filters.
If only specific IP addresses and/or services are allowed to be the source for traffic using the VIP, enable the Optional Filters.
- To specify an allowed address enter the value in the field labeled Source Address. The value can be formatted in three different ways.
- Source IP - Use the standard format for a single IP address
- Range - Enter the first and last members of the range
- Subnet - Enter the IP address of the broadcast address for the subnet.
To add additional addresses, click on the "+" below the last field with an address. To subtract an address, click on the "X" next to the field you wish to delete.
- To specify an allowed Service, toggle the Services option to enabled. Set the Services parameter by selecting the field with the "+" in the field. This will slide a window out from the right. Single or multiple options can be selected by highlighting the services wanted, unless the ALL option is chosen, in which case it will be the only option. For more information on services, check the Firewall Objects section called Services and TCP ports.
- Disable/Enable Port Forwarding. If only the traffic for a specific port or port range is being forwarded, enable this setting.
- Select the Protocol from
- Configure the External Service Port. This is the port(s) on the external interface of the FortiGate (the destination port in the header of the packets). The first field is for the first port in the range the second is for the last port in the range. As you enter a value in the first field, the second field will auto populate with the same number, working on the premise that a single port is common. Just edit the second field to extend the range.
- Configure the setting Map to Port.This will be the listening port on the device located on the internal side of the network. It does not have to be the same as the External Service Port. The first field is for the first port in the range the second is for the last port in the range. As you enter a value in the first field, the second field will auto populate with the same number, working on the premise that a single port is common. Just edit the second field to extend the range.
- Press OK.
This example is for a VIP that is being used to direct traffic from the external IP address to a web server on the internal network. The web server is for company use only. The company’s public facing web server already used port 80 and there is only one IP external IP address so the traffic for this server is being listened for on port 8080 of the external interface and being sent to port 80 on the internal host.
|Comments||Web server with Collaboration tools for Corporate employees|
|External IP Address/Range||18.104.22.168 <this would normally be a public IP address>|
|Mapped IP Address/Range||192.168.34.150|
|Source Address Filter||<list of IP addresses of remote users>|
|Services||enabled with HTTP in the list|
|Map to Port||80 - 80|