Skip to main content
commsrbrad
New Member
October 14, 2021
Question

Addresses within Address group have NAT with different IP addresses

  • October 14, 2021
  • 1 reply
  • 2296 views

Trying to find the best way to do this on a Fortigate.

On A Cisco ASA, when create object can do a NAT for it

eg Inside1 nat to outside1

     Inside2 nat to outside2

etc

then create a group

which contains Inside1 inside2 etc

then on the firewall ACL

allow the  group access to particular internet sites. (so only a one line entry for all inside objects)

so now as far as the Internet sites are concerned they will see traffic from the different NATed address for each object.

 

Now how do I do the same on the Forigate?

Now when I create an Address I cannot have a NAT for it

so with the Firewall rule I have to have an entry for each inside1 inside2 etc because they each use a different IP pool value

so it looks like to me I cannot use an Address group because I require a different internet IP for each member of the group

so more complicated to configure.

Is this correct?

    1 reply

    Toshi_Esumi
    SuperUser
    SuperUser
    October 14, 2021

    correct. Need to have one ippool for one SNAT IP, and one VIP for DNAT for opposite direction.

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!