Skip to main content
DenT88
Visitor III
March 4, 2025
Solved

Central Nat behavior - exemption "no nat" rule

  • March 4, 2025
  • 2 replies
  • 1348 views

Hello all - new to Fortigate Central Nat and just wanted to run something by the community here.

Looking to exempt NAT for a specific source and destination - while maintaining NAT\PAT to internet bound destinations for the same source. My questions are, can a "No NAT" rule be created\utilized in Central NAT, and how are the rules parsed\ matched ? Assume top-down correct?

 

Here's an example of what I'm after - 3 interfaces on the firewall. I just want to NOT nat the Forti voice ip when the destination is the CCUM server ip. Can I create a rule with those sources and destinations and just turn NAT off -then create a rule below for everything else internet bound?  Thanks in advance all

 

inside – outside – any – any – NAT\PAT  - to internet 

hosted –outside – Fortivoice IP – CCUM IPs– no NAT 

hosted – outside – any – any – NAT\PAT - to internet 

Best answer by pminarik

Yep, you certainly can! Just switch off the "NAT" toggle in the NAT policy.

cnat.png

And you're also correct about the matching order, top->down, first valid match wins.

2 replies

pminarik
Staff
pminarikAnswer
Staff
March 4, 2025

Yep, you certainly can! Just switch off the "NAT" toggle in the NAT policy.

cnat.png

And you're also correct about the matching order, top->down, first valid match wins.

DenT88
DenT88Author
Visitor III
March 5, 2025

Perfect ....Thanks for the quick reply !