The following diagram show the topology of our organization's network. We use two firewalls that one of them is a Fortigate 1500D and the other is OPNsense (firewall 2). Our network is connected to the Internet via two ISP (namely, 20.1.1.x/24 and 30.1.1.x/24). ISP-A is used for organization's servers (inbound: server updates and outbound: connecting people to the web and the other services) and ISP-B is used for connection users (LAN) to the Internet.
Recently we have decided to connect some of our servers to the Internet via ISP-B (inbound and outbound). To do that, we use port#32 interface of the Fortigate firewall.
We first define a virtual IP as:
edit "HTTP web server"
set uuid bla-bla-blla
set extip 20.1.1.50
set mappedip "192.168.1.50"
set extintf "any"
next
Then, we add a firewall policy to route the inbound traffic that received via p#32 interface to the DMZ zone via p#35 interface:
config firewall policy
edit 1
set name "ISP B to HTTP server"
set uuid bla-bla-bla
set srcintf "port32"
set dstintf "port35"
set action accept
set srcaddr "all"
set dstaddr "HTTP web server"
set schedule "always"
set service "HTTP"
set logtraffic all
next
end
But, when we try to connect to the web server from outside, it take some time and finally give up with ERR_CONECTION_TIMED_OUT.
I tried to debug it:
diagnose sniffer packet any 'host 20.1.1.50' 4 0 l
and the following is the results:
2026-02-19 06:48:42.552479 ISP-A out 20.1.1.50.57814 -> some-where-1.443: syn 2921345574
2026-02-19 06:48:42.552483 port15 out 20.1.1.50.57814 -> some-where-1.443: syn 2921345574
2026-02-19 06:48:44.553258 ISP-A out 20.1.1.50.57814 -> some-where-1.443: syn 2921345574
2026-02-19 06:48:44.553264 port15 out 20.1.1.50.57814 -> some-where-1.443: syn 2921345574
2026-02-19 06:48:48.554800 ISP-A out 20.1.1.50.57814 -> some-where-1.443: syn 2921345574
2026-02-19 06:48:48.554803 port15 out 20.1.1.50.57814 -> some-where-1.443: syn 2921345574
2026-02-19 06:49:38.756170 ISP-A out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:38.756173 port15 out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:39.007718 ISP-A out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:39.007721 port15 out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:39.758784 ISP-A out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:39.758788 port15 out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:40.012923 ISP-A out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:40.012926 port15 out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:41.768701 ISP-A out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:41.768705 port15 out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:42.021845 ISP-A out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:42.021848 port15 out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:45.773362 ISP-A out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:45.773365 port15 out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:46.024616 ISP-A out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:46.024619 port15 out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
according to the results, it seems that the packets go to the wrong path. But something is not clear for me: Why it is not show when and from which port the packets enter the Fortigate? Are they mapped to the correct internal IP (192.168.1.50)?
My main question: Why do the packets go to the wrong path (from ISP-B to ISP-A)? and how can I correct it?
Any help would be appreciated.
