Technical Tip: How to preserve source port when central NAT is enabled

In FortiOS running in no central SNAT mode, the preserve source port can be enabled in the firewall policy from the GUI/CLI.

config firewall policy

    edit <policy id>

        set fixedport <enable/disable>

end

In the Central SNAT mode, there is no more 'set fixedport <enable/disable>' command. 

The central SNAT table allows for more granular control over address translation performed by FortiGate. The NAT table defines rules for the source address or address group, and which IP pool the destination address uses.

The below are the only commands that can be set in Central NAT Mode.

config firewall central-snat-map
    edit <policyID number>
        set status {enable|disable}
        set orig-addr <valid address object preconfigured on the FortiGate>
        set srcintf <name of interface on the FortiGate>
        set dst-addr <valid address object preconfigured on the FortiGate>
        set dstintf <name of interface on the FortiGate>
        set protocol <integer for protocol number>
        set orig-port <integer for original port number>
        set nat-port <integer for translated port number>

set port-preserve <preservation of the original source port from SNAT> <----- Available since v7.4.4.

                 set dst-port <destination port or port range>  <----- Available since v7.2.8.
        set comments <string>
end

The following are the options to preserve the source port:

1. Configure an Overload type of IP Pool.
2. Enable the Explicit port mapping.
3. Set the source port range.
4. Copy the same into the translated source port.

Note:

• Explicit port mapping cannot apply to some protocols that do not use ports, such as ICMP. When enabling a NAT policy that uses Explicit port mapping, always consider that ICMP traffic will not match this policy.
• When using IP Pools, only the Overload type IP Pool allows Explicit port mapping. When Explicit port mapping is applied, it must define a source port range and a translated destination port range. The source port will map one-to-one with the translated port.
• 'Preserve Source Port' is enabled by default in FortiOS 7.4.4 and above. For more information, see Example five: Fine-tuning source port behavior - FortiGate 7.4.4 administration guide.
• Ports will only be preserved if the source port falls within the range of 5117 to 65532. Any source port below 5117 will automatically be translated to a port higher than 5117, and the preserve-port setting will not apply in that case: Technical Tip: Configure the destination port for the Central SNAT table