FortiGate Administration Guide - FirewallShop.com

Firewall Virtual IP
Configuring virtual IPs
To add a server load balance virtual IP to a firewall policy
Add a external to dmz1 firewall policy that uses the virtual IP so that when users
on the Internet attempt to connect to the web server IP address packets pass
through the FortiGate unit from the external interface to the dmz1 interface. The
virtual IP translates the destination address of these packets from the external IP
to the dmz network IP addresses of the web servers.
1 Go to Firewall > Policy and select Create New.
2 Configure the firewall policy:
Source Interface/Zone external
Source Address
All (or a more specific address)
Destination Interface/Zone dmz1
Destination Address Server_Load_Bal_VIP
Schedule
always
Service
HTTP
Action
ACCEPT
3 Select NAT.
4 Select OK.
Adding a server load balance port forwarding virtual IP
In this example, connections to 192.168.37.4 on the Internet are mapped to
10.10.10.42, 10.10.10.43, and 10.10.10.44 on a private network. The IP address
mapping is determined by the FortiGate unit’s load balancing algorithm. The
external service port on 192.168.37.4 is mapped to specified ports in conjunction
with the specified IP addresses. The computers on the Internet are unaware of
this translation and see a single computer at 192.168.37.4 rather than a FortiGate
unit with a private network behind it.
Figure 204:Server load balance virtual IP port forwarding
To add a server load balance port forwarding virtual IP
1 Go to Firewall > Virtual IP > Virtual IP.
2 Select Create New.
3 Use the following procedure to add a virtual IP that allows users on the Internet to
connect to a web server on the DMZ network. In our example the external
interface of the FortiGate unit is connected to the Internet and the dmz1 interface
is connected to the DMZ network.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 319