Technical Tip: SD-WAN Zone Support in Central SNAT

Use Case.

Previously, Central SNAT policies only supported specifying physical interfaces. Beginning with FortiOS v7.6.1, SD-WAN zones can be used as destination interfaces in Central SNAT policies. This simplifies NAT rule configuration in SD-WAN deployments.

Example configuration (Central SNAT Using SD-WAN Zone).

config firewall central-snat-map     edit 1         set src-addr "internal_subnet"         set dst-addr "all"         set protocol 6         set srcintf "LAN"         set dstintf "SDWAN_ZONE"         set orig-ports 0-65535         set mappedip "203.0.113.100"         set mapped-ports 0-65535     next end

In this example:

• SDWAN_ZONE refers to the SD-WAN zone name defined under config system sdwan.
• The mapped IP is applied when egress traffic exits via any interface in that zone.

Feature Availability.

Available in FortiOS v7.6.1 and later via both GUI and CLI.

Additional Policy Types Supporting SD-WAN Zones.

• Local-In policies.
• DoS policies.
• Multicast policies.
• TTL policies.

Operational Considerations.

• Ensure that the SD-WAN zone used in Central SNAT matches the zone configured in config system sdwan.
• Using zones instead of specific interfaces allows broader and more resilient rule application across all member interfaces.
• This capability enhances maintainability in dynamic WAN environments.