Configuring a FortiGate unit for Xbox

‎11-28-2007

Article

Description

Connecting an Xbox 360 to the Xbox Live service through a Fortigate-protected network.

Components

Microsoft Xbox 360
All FortiGate units

Steps or Commands

According to the Microsoft KB article ID 908874:

If there is a firewall device between the Xbox console and the network device, you may have to configure the firewall to enable communication on specific network ports. If the NAT status in the Network Status area of the Dashboard is "moderate" or "strict," you may have to configure port settings. ?
The following ports must be available for Xbox Live to operate correctly:
UDP/TCP 88
UDP/TCP 3074
UDP/TCP 2074

You can configure the Xbox on a FortiGate unit using Virtual IPs and an inbound firewall policy. This configuration requires the Xbox or Xbox 360 to be configured with a static IP address.

Create Virtual IPs

Create the Virtual IP required for this configuration.

To add a virtual IP

Go to Firewall> Virtual IP.
Select Create New.
Add a name for the virtual IP, such as 360_TCP_3074.
Select the External Interface.

This will typically be the interface that connects your FortiGate unit to the Internet. Most often, this is "external" or "wan1".

Set Type to Static NAT.
Set the External IP Address. You can use:
- The FortiGate unit public IP.
- If you have a cable or DSL connection with a dynamic IP, you can use 0.0.0.0.
Set Mapped IP Address to the internal IP address of the Xbox 360.
Select Port Forwarding.
Set protocol to TCP.
Set External Service Port and Map to Port. Set both External Service Port and Map to Port to 3074.
Select OK.

Repeat this process for UDP port 3074.

Go to Firewall> Virtual IP.
Select Create New.
Add a name for the virtual IP, such as 360_UDP_3074.
Select the same external interface as with the last VIP.
Set Type to Static NAT.
Set the same External IP Address as the previous VIP.
Set Mapped IP Address to the internal IP address of the Xbox 360.
Select Port Forwarding.
Set protocol to UDP.
Set External Service Port and Map to Port. Set both External Service Port and Map to Port to 3074.
Select OK.

Create VIPs for UDP and TCP ports 2074.

Go to Firewall> Virtual IP.
Select Create New.
Add a name for the virtual IP, such as 360_TCP_3074.
Select the External Interface. This will typically be the interface that connects your FortiGate unit to the Internet. Most often, this is "external" or "wan1".
Set Type to Static NAT.
Set the External IP Address. You can use:
- The FortiGate unit public IP.
- If you have a cable or DSL connection with a dynamic IP, you can use 0.0.0.0.
Set Mapped IP Address to the internal IP address of the Xbox 360.
Select Port Forwarding.
Set protocol to TCP.
Set External Service Port and Map to Port. Set both External Service Port and Map to Port to 2074.
Select OK.

Go to Firewall> Virtual IP.
Select Create New.
Add a name for the virtual IP, such as 360_UCP_2074.
Select the External Interface. This will typically be the interface that connects your FortiGate unit to the Internet. Most often, this is "external" or "wan1.
Set Type to Static NAT.
Set the External IP Address. You can use:
- The FortiGate unit public IP.
- If you have a cable or DSL connection with a dynamic IP, you can use 0.0.0.0.
Set Mapped IP Address to the internal IP address of the Xbox 360.
Select Port Forwarding.
Set protocol to UDP.
Set External Service Port and Map to Port. Set both External Service Port and Map to Port to 2074.
Select OK.

Finally, repeat this process for the last port, UDP 88.

Go to Firewall> Virtual IP.
Select Create New.
Add a name for the virtual IP, such as 360_UDP_88.
Select the same external interface as with the last VIP.
Set Type to Static NAT.
Set the same External IP Address as the previous VIP.
Set Mapped IP Address to the internal IP address of the Xbox 360.
Select Port Forwarding.
Set protocol to UDP.
Set External Service Port and Map to Port. Set both External Service Port and Map to Port to 88.
Select OK.

These VIPs can be grouped in all versions of FortiOS 3.0 from build MR3 and higher.

To create a VIP group

Go to Firewall> Virtual IP> VIP Group.
Select Create New.
Enter a name for the group, such as Xbox 360.
Select wan1 or external as the external interface.
Move all three VIPs created above to the members box.
Select OK.

Create a firewall policy

Create a firewall policy for that includes the VIP group.

To add a firewall policy with a virtual IP

Go to Firewall> Policy.
Select Create New.
Set Source Interface to WAN1 (or whatever your external interface to the Internet is).
Set Source Address to all.
Set Destination Interface to the internal port.
Set Destination Address to the name of the Virtual IP group.
Enable Fixed Port.
Select OK.