New Member

Solved

Can translate source port "Any" to a specific port on fortinet central SNAT?

Forum|Forum|9 months ago
December 12, 2025
4 replies
575 views

Hi , can someone pls advise whether can translate source port "Any" to a specific tcp port on fortinet central SNAT? thanks in advance !

Best answer by kaman

Hi WQ,

To configure a specific source port range to be used from the FortiGate a Central SNAT policy must be used. The option to translate source ports is only available when a dynamic IP pool is used.

Reference Link: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-source-port-translation-using/ta-p/338853

On FortiOS 7.4.x is introduced a new feature which will allow adding a destination-port as a criterion to config a firewall Central-NAT rule.

To configure a dst-port it is only possible to use CLI, the destination port is not visible on the GUI.

Reference Link: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-the-destination-port-for-the-Central/ta-p/256507

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards,
Aman

kamanAnswer

Staff

Hi WQ,

To configure a specific source port range to be used from the FortiGate a Central SNAT policy must be used. The option to translate source ports is only available when a dynamic IP pool is used.

Reference Link: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-source-port-translation-using/ta-p/338853

On FortiOS 7.4.x is introduced a new feature which will allow adding a destination-port as a criterion to config a firewall Central-NAT rule.

To configure a dst-port it is only possible to use CLI, the destination port is not visible on the GUI.

Reference Link: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-the-destination-port-for-the-Central/ta-p/256507

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards,
Aman

Carson_Daniels

New Member

FortiGate Central SNAT cannot translate “Any” source port to one fixed TCP port. It only uses dynamic port allocation (PAT).
To control ports, you’d need policy-based NAT, and even then fixed source ports are very limited and not recommended.

WQTpicapAuthor

New Member

hi @Carson_Daniels @kaman , there is one field "Explicit Port Mapping" under central SNAT, can translate the source port range to a specific port, please verify. Thanks.

hooram95

New Member

FortiGate Central SNAT doesn’t really support translating a source port defined as “Any” into one fixed, specific TCP port, since source ports are normally dynamically assigned to avoid conflicts. You can control destination ports pretty well, but forcing all traffic to use a single source port would likely cause session issues and isn’t how SNAT is designed to work. If you have a specific use case, it might be better handled with a different policy approach or by adjusting the application or service instead of the SNAT itself.

Sign up

Login with SSO

Login to the community

Login with SSO