Fortigate SSH VIP DNAT Configuration Guide (v7.4.8)

Introduction

Hey guys! Today, we're diving deep into setting up a Virtual IP (VIP) and Destination NAT (DNAT) on a Fortigate 1000F running v7.4.8, specifically for SSH access to an internal IP address. This is a common scenario for allowing secure external access to resources within your network, and it's crucial to get it right to maintain both security and functionality. We'll walk through the configuration step-by-step, ensuring you understand each part of the process. This guide aims to provide a comprehensive understanding of how to configure VIP DNAT for SSH on your Fortigate, focusing on practical implementation and troubleshooting. Whether you're a seasoned network engineer or just starting out, this article will equip you with the knowledge to set up secure remote access to your internal resources. Let's get started and make sure your network is both accessible and secure!

The goal here is to allow external users to connect to an internal server via SSH, but without directly exposing the internal IP address to the internet. This is achieved by creating a VIP, which acts as a public-facing IP, and then using DNAT to translate the traffic from the VIP to the actual internal server. We'll also configure firewall policies to control which traffic is allowed to reach the VIP and subsequently the internal server. Security is paramount, so we'll cover best practices to ensure your SSH access is locked down tight. By the end of this guide, you'll have a solid understanding of how to configure VIP DNAT for SSH, troubleshoot common issues, and implement security measures to protect your network.

Remember, the key to a successful setup lies in understanding the underlying concepts and carefully configuring each step. We'll break down the process into manageable chunks, providing clear explanations and practical examples. So, grab your favorite beverage, fire up your Fortigate, and let's get this done! We'll cover everything from the initial VIP creation to the final firewall policy configuration, ensuring you have a complete and secure setup. Let's make sure those SSH connections are flowing smoothly and safely!

Understanding VIP and DNAT

Before we jump into the configuration, let's clarify what VIP and DNAT actually mean in the context of Fortigate firewalls. A Virtual IP (VIP) is essentially a public IP address that you configure on your Fortigate. It acts as a gateway for external traffic destined for your internal network. Think of it as a receptionist who receives calls for different departments within a company. The receptionist (VIP) then forwards the call to the correct extension (internal IP). This abstraction is crucial for security because it hides your internal network topology and IP addresses from the outside world.

Destination NAT (DNAT), on the other hand, is the mechanism that translates the traffic arriving at the VIP to the internal IP address. It's the receptionist knowing which extension to forward the call to. When a connection request hits the VIP, DNAT rewrites the destination IP address to the internal server's IP address. This way, the external user connects to the VIP, but the traffic is actually routed to the internal server. This is incredibly powerful because it allows you to expose specific services to the internet without directly exposing the entire internal network. For example, you might have a web server, an SSH server, or a database server that needs to be accessible from the outside, but you don't want to put these servers directly on the public internet.

In our case, we're using VIP and DNAT to allow external SSH access to an internal server. When an external user tries to connect to the VIP on port 22 (the default SSH port), DNAT will translate this connection to the internal server's IP address and port 22. This way, the external user can securely connect to the server without knowing its actual internal IP address. By using VIP and DNAT, we add a layer of security and control over how external traffic interacts with our internal network. It's like having a secure tunnel that only allows specific types of traffic to pass through, keeping the rest of your network safe and sound. This is a fundamental concept in network security, and mastering it is essential for any network administrator.

Step-by-Step Configuration

Alright, let's get our hands dirty and dive into the configuration steps for setting up VIP DNAT for SSH on your Fortigate 1000F with v7.4.8. We'll break it down into easy-to-follow instructions, so you can be sure you're getting everything just right. First, we'll create the VIP, then configure the DNAT, and finally, we'll set up the firewall policies to allow the traffic.

1. Create the Virtual IP (VIP)

Log into your Fortigate's web interface. Navigate to Firewall Objects > Virtual IPs and click Create New > Virtual IP. Here, you'll need to fill in the details for your VIP. Give it a descriptive name, such as SSH_VIP. For the Interface, select the interface that faces the internet, typically your WAN interface (e.g., wan1). In the External IP Address field, enter the public IP address that you want to use for the VIP. This is the IP address that external users will connect to. Now, for the crucial part: the Mapped IP Address. This is where you put the internal IP address of the server you want to SSH into. Make sure this is the correct IP address, or your connections won't go where they're supposed to! Set the Port Forwarding option to Enable. This is what allows us to forward specific ports to the internal server. Under Port Forwarding, set the Protocol to TCP, the External Service Port to 22 (the standard SSH port), and the Internal Service Port to 22 as well. You can choose a different external port for security reasons (e.g., 2222), but for simplicity, we'll stick with 22 for now. Click OK to save your VIP.

2. Configure the DNAT Policy

Now that we have our VIP, we need to create a firewall policy that uses DNAT to forward traffic to the internal server. Go to Firewall & Security Policies > Firewall Policy and click Create New. In the policy settings, give it a name like SSH_DNAT_Policy. Set the Incoming Interface to your WAN interface (e.g., wan1) and the Outgoing Interface to the interface connected to your internal network (e.g., internal). For the Source Address, you can either specify a particular IP address or subnet that you want to allow SSH access from, or you can set it to all to allow SSH from any external IP address (not recommended for security reasons). The Destination Address should be your newly created VIP (SSH_VIP). Set the Schedule to always for now, but you might want to create a schedule that only allows SSH access during specific times for added security. Set the Service to SSH. Under Action, make sure ACCEPT is selected. Enable NAT (this is the DNAT part!) and click OK to save your policy.

3. Additional Security Considerations

Before we wrap up, let's talk about security. Allowing SSH access from anywhere is generally not a good idea. It opens you up to brute-force attacks and other security risks. A better approach is to restrict SSH access to specific IP addresses or networks. You can do this by modifying the Source Address in your firewall policy. Instead of all, specify the IP addresses or subnets that you want to allow SSH access from. Another security measure is to use a non-standard SSH port on the external interface. For example, you could use port 2222 instead of 22. This makes it slightly harder for attackers to find your SSH server. However, keep in mind that this is just security through obscurity, and it's not a substitute for strong passwords and other security measures. Finally, make sure you have strong passwords for your SSH users, and consider using SSH key-based authentication for even stronger security. Key-based authentication is much more secure than passwords because it's much harder to crack. By implementing these security measures, you can significantly reduce the risk of unauthorized access to your internal server.

Troubleshooting Common Issues

Even with the best instructions, sometimes things don't go exactly as planned. Let's troubleshoot some common issues you might encounter when setting up VIP DNAT for SSH on your Fortigate. We'll cover connectivity problems, policy misconfigurations, and other potential pitfalls. By understanding these issues and how to resolve them, you'll be well-equipped to handle any challenges that come your way.

1. Connectivity Issues

One of the most common problems is simply not being able to connect to the SSH server. If you can't connect, the first thing to check is your network connectivity. Can you ping the VIP from an external network? If not, there might be a problem with your routing or your internet connection. Make sure your Fortigate has a default route configured and that your internet connection is working properly. If you can ping the VIP, but you still can't connect via SSH, the problem is likely with the firewall policy or the DNAT configuration. Double-check that your firewall policy is allowing SSH traffic to the VIP and that DNAT is enabled. Also, verify that the Mapped IP Address in your VIP configuration is correct. A simple typo can prevent connections from being forwarded to the internal server.

2. Firewall Policy Misconfigurations

Another common issue is misconfigured firewall policies. If your policy isn't set up correctly, traffic won't be allowed to reach the VIP or the internal server. Make sure your Incoming Interface, Outgoing Interface, Source Address, Destination Address, and Service are all configured correctly. Pay close attention to the Destination Address – it should be your VIP. Also, ensure that the Action is set to ACCEPT and that NAT is enabled. If you've restricted SSH access to specific IP addresses, double-check that the source IP address you're connecting from is included in the policy. A missing or incorrect rule can easily block SSH traffic. It's also worth checking the policy order. Fortigate processes policies in order, so if you have a policy that's blocking SSH traffic before your DNAT policy, your connections won't work. Make sure your DNAT policy is placed higher in the list than any conflicting policies.

3. DNAT Configuration Problems

Problems with the DNAT configuration itself can also cause connectivity issues. Verify that the Port Forwarding option is enabled in your VIP settings and that the External Service Port and Internal Service Port are set correctly. If you're using a non-standard external SSH port, make sure you're connecting to that port. For example, if you've set the External Service Port to 2222, you'll need to connect to your VIP on port 2222, not 22. Additionally, double-check that the Protocol is set to TCP. SSH uses TCP, so if you've accidentally set it to UDP, your connections won't work. It's these small details that can often trip you up, so careful verification is key.

4. Using Fortigate's Diagnostic Tools

Fortigate provides some excellent diagnostic tools that can help you troubleshoot network issues. The diagnose debug flow command is particularly useful for tracing the path of packets through your firewall. You can use this command to see if traffic is hitting your VIP, if it's being DNATed correctly, and if it's being allowed by your firewall policies. To use this command, connect to your Fortigate's CLI and enter diagnose debug flow filter addr <VIP IP Address> (replace <VIP IP Address> with your actual VIP IP address). Then, enter diagnose debug flow show function-name enable and diagnose debug flow trace start 100. Now, try to connect to your SSH server. The output from the diagnose debug flow command will show you exactly what's happening to the packets as they traverse your firewall. This can help you pinpoint where the problem lies. Another useful tool is the ping command. You can use it to test basic network connectivity. From the Fortigate's CLI, you can ping both external and internal IP addresses to verify that your routing is configured correctly.

Best Practices for Secure SSH Access

Security should always be a top priority when setting up remote access to your network. SSH, while generally secure, can still be vulnerable if not configured properly. Let's go over some best practices for securing your SSH access through a Fortigate firewall. These tips will help you minimize the risk of unauthorized access and keep your network safe and sound. By implementing these measures, you'll significantly enhance the security posture of your SSH connections.

1. Restrict Source IP Addresses

As we mentioned earlier, allowing SSH access from any IP address is a security risk. It opens you up to brute-force attacks and other malicious activities. A much better approach is to restrict SSH access to specific IP addresses or networks that you trust. You can do this by modifying the Source Address in your firewall policy. Instead of all, specify the IP addresses or subnets that should be allowed to connect. This limits the attack surface and makes it much harder for unauthorized users to gain access. For example, if you only need to access your SSH server from your home network, you can specify your home IP address or subnet in the policy. If you have multiple trusted networks, you can add them all to the policy. This simple step can significantly improve your security.

2. Use a Non-Standard SSH Port

The default SSH port is 22. Attackers know this, and they often target this port in their attacks. Changing the SSH port to a non-standard port (e.g., 2222, 30022, etc.) can help to reduce the number of automated attacks. This is sometimes referred to as "security through obscurity," but it can be an effective first line of defense. To change the SSH port, you'll need to modify the External Service Port in your VIP configuration. However, keep in mind that this is not a substitute for strong authentication and other security measures. It's just one layer of defense in a multi-layered security strategy. If you do change the port, make sure you remember the new port number and configure your SSH clients to connect to the new port.

3. Implement Key-Based Authentication

Key-based authentication is a much more secure alternative to password-based authentication. With key-based authentication, you use a pair of cryptographic keys – a private key and a public key – to authenticate. The private key is stored securely on your client machine, and the public key is placed on the server. When you connect to the server, the server uses the public key to verify your identity. Because the private key never leaves your client machine, it's much harder for attackers to steal your credentials. To implement key-based authentication, you'll need to generate a key pair on your client machine and then copy the public key to the ~/.ssh/authorized_keys file on your server. You'll also need to disable password-based authentication on your server to prevent attackers from trying to brute-force your password. Key-based authentication provides a much stronger level of security and is highly recommended for all SSH connections.

4. Disable Password Authentication

Once you've implemented key-based authentication, you should disable password authentication altogether. This prevents attackers from trying to brute-force passwords and greatly reduces the risk of unauthorized access. To disable password authentication, you'll need to edit the /etc/ssh/sshd_config file on your server. Look for the PasswordAuthentication setting and set it to no. Then, restart the SSH service for the changes to take effect. By disabling password authentication, you're forcing users to use key-based authentication, which is much more secure. This is a crucial step in securing your SSH access.

5. Keep Your Fortigate Firmware Up-to-Date

Keeping your Fortigate firmware up-to-date is essential for security. Fortinet regularly releases firmware updates that include security patches and bug fixes. These updates address vulnerabilities that attackers could exploit to gain access to your network. Make sure you're running the latest stable version of Fortigate firmware and that you're applying updates promptly. You can check for updates in the Fortigate's web interface under System > Firmware. Regularly updating your firmware is a fundamental security practice that helps protect your network from known vulnerabilities.

Conclusion

Alright guys, we've covered a lot in this guide! We've walked through the process of setting up VIP DNAT for SSH on a Fortigate 1000F with v7.4.8, troubleshooting common issues, and implementing best practices for secure SSH access. By now, you should have a solid understanding of how to configure your Fortigate to allow secure remote access to your internal resources. Remember, security is an ongoing process. It's not something you set up once and forget about. Regularly review your configurations, apply security updates, and stay informed about the latest threats and vulnerabilities. This proactive approach will help you keep your network safe and secure. We've gone from the basics of VIP and DNAT to the nitty-gritty of firewall policies and security considerations. You've learned how to create a VIP, configure DNAT, and set up firewall policies to allow SSH traffic. We've also delved into troubleshooting common issues, such as connectivity problems and misconfigured policies. And, most importantly, we've discussed best practices for securing your SSH access, including restricting source IP addresses, using a non-standard SSH port, implementing key-based authentication, and disabling password authentication. By following these practices, you can significantly enhance the security of your SSH connections.

Setting up VIP DNAT for SSH is a fundamental skill for any network administrator. It allows you to provide secure remote access to your internal servers without exposing them directly to the internet. This is crucial for maintaining the security and integrity of your network. The knowledge you've gained in this guide will serve you well in your networking endeavors. Remember to always prioritize security and to stay vigilant in protecting your network. We've equipped you with the tools and knowledge you need to set up secure SSH access, troubleshoot issues, and implement best practices. Now, it's up to you to put this knowledge into practice and keep your network safe and sound. So, go forth and conquer those network challenges! And remember, if you ever get stuck, this guide will be here to help you along the way. Happy networking!