Convert ASA Static NAT to Fortigate DNAT VIP

Hello johnlloyd_13, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

Hello again,

The conversion from ASA to FortiGate using FortiConverter for a NAT between two internal networks appears mostly correct, but there are a few points to consider:

1. VIP Configuration: The `extip` should be the external IP address that is visible to the outside network, and `mappedip` should be the internal IP address. In your FortiGate configuration, it seems you have set `extip` as `172.18.7.7` and `mappedip` as `172.29.13.1`. Ensure these are correctly mapped as per your network design.
   
   
2. Firewall Policy: The policy should have `nat` enabled if you want to perform NAT. In your configuration, `set nat disable` is specified, which means NAT will not be performed. If NAT is required, change it to `set nat enable`.
   
   
3. Interface Names: Ensure that the interface names (`po20.60` and `po20.61`) match the actual interface names on your FortiGate device.
   
   
4. Routing: Ensure that the routing configurations on the FortiGate are set up to match the ASA's routing logic. This is not shown in your FortiGate configuration snippet.
   
   
5. Service and Address Objects: Ensure that any service or address objects used in the ASA configuration are correctly translated to FortiGate objects. Make sure to test the configuration in a controlled environment before deploying it in production to ensure it behaves as expected.

Hope it helps you, if not do not hesitate to tell us!

Hi John

I'm not used to ASA, but according to some Cisco docs, in your case the external IP 172.29.13.1 on the external interface 20.61 should be mapped to host 172.18.7.7 on the internal interface 20.60. So the VIP should be defined as follows:

config firewall vip
 edit "vip-172.29.13.1"
  set extip 172.29.13.1
  set mappedip 172.18.7.7
  set extintf "po20.61"
 next
end

 The firewall rule looks fine.