Technical Tip: NAT46 VIP with src-filter may still forward non-matching traffic to naf.traffic

An example scenario is shown below:

VIP configuration:

config firewall vip edit "VIP46_Obj_198_51_100_114" set src-filter "10.10.10.218" set extip 198.51.100.114 set nat46 enable set extintf "any" set arp-reply disable set ipv6-mappedip 2001:db8:20::a49:1 next end

Central SNAT:

config firewall central-snat-map edit 1 set srcintf "port2" set orig-addr "Obj_10_10_10_218" set dst-addr "Obj_198_51_100_114" set nat46 enable set nat-ippool6 "ippool6" next end

Firewall policy:

config firewall policy edit 2 set srcintf "port2" set dstintf "port3" set action accept set srcaddr "Obj_10_10_10_218" "Obj_10_10_10_219" set dstaddr "all" set schedule "always" set service "ALL" next end

Expected behavior:

• 10.10.10.218 -> 198.51.100.114 should match the VIP and use NAT46.
• 10.10.10.219 -> 198.51.100.114 should not match the VIP src-filter and should continue as normal IPv4 traffic.

Observed behavior:

• Traffic from 10.10.10.218 is forwarded correctly through NAT46
• Traffic from 10.10.10.219 is dropped by forward policy check

For the non-matching source 10.10.10.219, the packet does not match DNAT, but it is still routed to naf.traffic and then dropped. The relevant debug flow output is shown below:

received a packet(proto=1, 10.10.10.219:30071->198.51.100.114:2048) from port2
iprope_dnat_check ... ret-no-match
find a route: gw-0.0.0.0 via naf.traffic
checked gnum-100004 policy-4, ret-no-match
checked gnum-100004 policy-0, ret-matched
policy-0 is matched, act-drop
Denied by forward policy check (policy 0)

For the matching source 10.10.10.218, the packet matches the NAT46 VIP and is forwarded successfully. 

Successful debug flow is shown below:

received a packet(proto=1, 10.10.10.218:28791->198.51.100.114:2048) from port2
find DNAT46: IP-2001:db8:20::a49:1
matched policy
find a route: gw-0.0.0.0 via naf.traffic
Allowed by Policy-4: SNAT

Routing table behavior:

Without a workaround, the FortiGate installs a route for the VIP external IP toward naf.traffic:

get router info routing-table all
...
S 198.51.100.114/32 [1/0] is directly connected, naf.traffic

Because of this, traffic destined to the VIP external IP may still be forwarded to naf.traffic even when the source does not match the VIP src-filter.

Explanation:

For NAT46/NAT64, FortiGate uses naf.traffic to perform protocol translation and feed the packet back into the network stack with the new IP version.

Because of this design, traffic to the VIP external IP may still be pulled into the NAT46 path even if the source address does not match the VIP src-filter.

This is why the behavior does not match NAT44.

Workaround:

A policy route can be used so traffic that should not use NAT46 is forced to the normal IPv4 path.

Example:

config router policy edit 1 set input-device "port2" set src "10.10.10.219/255.255.255.255" set dst "198.51.100.114/255.255.255.255" set gateway 10.11.11.73 set output-device "port3" next end

A scalable alternative is to negate the source that should use NAT46:

config router policy edit 1 set input-device "port2" set src "10.10.10.218/255.255.255.255" set src-negate enable set dst "198.51.100.114/255.255.255.255" set gateway 10.11.11.73 set output-device "port3" next end

With the policy route workaround, the policy route takes precedence over the static route, so traffic is forwarded through the normal IPv4 path instead of being sent to naf.traffic.

Summary:

In NAT46 VIP deployments, traffic that does not match the VIP src-filter may still be routed to naf.traffic based on the VIP external IP and then be dropped by policy 0. A validated workaround is to use a policy route so non-matching traffic bypasses the NAT46 path.