FortiGate 60C and Port Forwarding

Question

Without going into too much detail, I'm in over my head due to recent staffing changes and a lot of extra responsibilities falling into my lap that are outside my current area of expertise. So any help, even a push in the direction of proper terminology will help figure this out.

I have a Windows 2008 R2 server that is being setup as a test server by an outside company for a potential CRM. Everything was going fine with the setup until they went to import sample data into the CRM and needed additional ports "opened" for the import. I opened those ports on the server itself, which didn't work as (I'm assuming) our FortiGate firewall is blocking them.

We have a FortiGate 60C and I've spent much of the day poking around in the web interface for the device and trying to read through the documentation, but nothing I've found looks like a promising solution. I am assuming that by "opening the ports" our CRM vendor means they need the ports forwarded to the test server but beyond that, I'm stumped as far as the FortiGate goes.

Thanks in advance, and please feel free to answer as though I'm clueless because at this point I feel like I am!

Answer 1

This should be quite straight forward - you'll just need to bind the pin hole to the virtual IP set up on the external interface. What it may pay to do first is understand the current configuration - what port is the external interface - what port is the internal - and the ip(s) address that are bound to both these interfaces. Also if you are NAT'ing across the external interface. Diagrams are great here.

To set up the publishing rule you may need to set up the service (the port you are opening if it's custom), the address of the internal server and source (if this is required)

The manual for the 60c is here http://docs.fortinet.com/fgt/archives/2.8MR7/01-28007-0002-20041203_FortiGate-60_Admin_Guide.pdf page 192 is where you would want to start from.

Take it one step at a time and test. When you test ensure you don't get caught out with the firewall on the server - so telnet to the server internally, then try from the external interface (just hang a laptop on the external interface).

In no time you'll be a 40 pro...