Skip to main content
Jamshaid
Jamshaid
Explorer
June 21, 2023
Question

A tricky NAT statement in ASA to be converted in Fortinet

  • June 21, 2023
  • 3 replies
  • 1400 views

Hey 

 

So I am currently handling a migration from ASA to Fortinet for which I had encountered many challenging NAT statements but this one is the most confusing with not much solution available as per my research so far. Any help would be appreciated 

 

So there is this NAT statement in ASA 

 

nat (dmz,inside) source static obj-1.1.1.1 obj-1.1.1.1  destination static obj-2.2.2.2 obj-3.3.3.3

 

Similarly 

 

nat (inside,outside) source dynamic obj-5.5.5.5 obj-6.6.6.6 destination static host-4.4.4.4 host-4.4.4.4

 

How would I be able to achieve this in Fortigate ( I am using central enabled in our deployment )

3 replies

Anthony_E
Staff
Anthony_E
Staff
June 24, 2023

Hello,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Best Regards
    Anthony_E
    Staff
    Anthony_E
    Staff
    June 27, 2023

    Hello,

     

    We are still looking for someone to help you.

    We will come back to you ASAP.


    Regards,

    Best Regards
    Debbie_FTNT
    Staff & Editor
    Debbie_FTNT
    Staff & Editor
    July 3, 2023

    Hey Jamshaid,

    from what I have been able to find, you would have to break down those statements:

    - FortiGate would have a Central NAT (or a Central SNAT and DNAT) table, with separate rules for SNAT and DNAT

    -> the NAT statements above would need to be separated into the source and destination parts

    -> "source static obj-1.1.1.1 obj-1.1.1.1" for example would translate to a Source NAT entry with real IP 1.1.1.1 and mapped IP 1.1.1.1 (or whatever is appropriate)
    -> "destination static obj-2.2.2.2 obj-3.3.3.3" would translate to a Destination NAT entry with real IP 2.2.2.2 and mapped IP 3.3.3.3 (or whatever IPs are appropriate)
    -> the interfaces and linking the SNAT and DNAT rules would happen via a firewall policy

      Terms & ConditionsAccessibility statement