Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kish02
New Contributor

Setup NAT to Web Server with SD-Wan Interface

Hi guys,

 

What is the right procedure when creating NAT to my web server. should be accessible outside using a public ip of the same subnet as my wan interface. i am using sd-wan interface. thank you in advance.

2 Solutions
bpozdena_FTNT

DNAT on Fortigate is configured using Virtual IPs.  It's exactly the same with or without SDWAN.

 

See the below documentation for more details:
https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/728694/destination-nat

HTH,
Boris

View solution in original post

AEK

Yes you need a firewall policy, like this:

  • srcintf: e.g.: WAN
  • dstintf: e.g.: DMZ
  • src: ALL (or some public IP, or some GeoIP)
  • dst: VIP_object
  • service: HTTPS or other
  • UTM: any security you need
AEK

View solution in original post

AEK
8 REPLIES 8
bpozdena_FTNT

DNAT on Fortigate is configured using Virtual IPs.  It's exactly the same with or without SDWAN.

 

See the below documentation for more details:
https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/728694/destination-nat

HTH,
Boris
kish02

Sorry for the late response, got busy with other matters. Once i have configured the virtual ip, do i need to create a firewall policy?

 

VIP setup

Type: Static Nat
External IP: Wan1 public ip(i have other static ip aside from what is set on wan1 interface)

Map to: Local test server

 

I have searched for DNAT procedures online and they created firewall policy as well.

 

AEK

Yes you need a firewall policy, like this:

  • srcintf: e.g.: WAN
  • dstintf: e.g.: DMZ
  • src: ALL (or some public IP, or some GeoIP)
  • dst: VIP_object
  • service: HTTPS or other
  • UTM: any security you need
AEK
AEK
kish02
New Contributor

Thanks for the quick response. I am using sd-wan interface with 2 ISPs as member. Will it still work if i setup like below:

  • srcintf: virtual-wan interface
  • dstintf: e.g.: DMZ
  • src: ALL (or some public IP, or some GeoIP)
  • dst: VIP_object
  • service: HTTPS or other
  • UTM: any security you need

 

 

AEK

Sure it will.

AEK
AEK
kish02
New Contributor

Thank you.

AEK
SuperUser
SuperUser

Hi @kish02 

When configuring DNAT, you can either use the WAN interface's IP or use another public IP (if your ISP has provided you with extra public IP addresses).

AEK
AEK
hbac
Staff
Staff
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors