Fortigate -- VIP Service Port vs. Policy Service

Important Concept

The service of firewall policy is defined protocol between source interface and destination interface. It might straightforward on the service configuration when setup standard protocol between two interfaces, but it might get confused when you customize port and set it on the firewall policy.

Scenario

We have a web server host internally and need to public to Internet with static WAN IP address. We don't want to use standard HTTP and HTTPs port on the internet.

Condition (All conditions below are fake value)

• Web Server Internal IP: 192.168.1.10
• Web Server Internal Service Port: HTTP(80), HTTPS(443)
• Web Service Internet IP: 8.8.8.9
• Web Service Internet Port: HTTP(9980), HTTPS(9443)

Initial Configuration

1. Create new Virtual IP (VIP)
   config firewall vip
       edit "Web Service HTTP"
           set extip 8.8.8.9
           set extintf "WAN"
           set portforward enable
           set mappedip 192.168.1.10
           set extport 9980
           set mappedport 80
       next
       edit "Web Service HTTPS"
           set extip 8.8.8.9
           set extintf "WAN"
           set portforward enable
           set mappedip 192.168.1.10
           set extport 9443
           set mappedport 443
2. Create Custom Service
   config firewall service custom
           edit "TCP_9980"
                   set protocol TCP/UDP/SCTP
                   set tcp-portrange 9980
           next
           edit "TCP_9443"
                   set protocol TCP/UDP/SCTP
                   set tcp-portrange 9443
           next
3. Create Firewall Policy
   config firewall policy
           edit 72
                   set srcintf "WAN"
                   set dstintf "Internal"
                           set srcaddr "all"
                           set dstaddr "Web Service HTTP" "Web Service HTTPS"
                   set action accept
                   set schedule "always"
                           set service "TCP_9980" "TCP_9443"
                   set logtraffic enable
           next

Issue of Initial Configuration

After the setup, I tried to connect from Internet to customize port but fail. Why??

Refer to the beginning subject, "The service of firewall policy is defined protocol between source interface and destination interface."
Base on my requirement, Internet users access to my web service must connect to customized port 9980 and 9443, but between interface "WAN" and "Internal", it should be standard port of HTTP and HTTPS, that is why connection fail on the initial configuration.

Correct Configuration

3. Create Firewall Policy

config firewall policy
        edit 72
                set srcintf "WAN"
                set dstintf "Internal"
                        set srcaddr "all"
                        set dstaddr "Web Service HTTP" "Web Service HTTPS"
                set action accept
                set schedule "always"
                        set service "HTTP" "HTTPS"
                set logtraffic enable
        next

Schematic diagram