Skip to main content
johnlloyd_13
johnlloyd_13
Explorer III
February 6, 2024
Question

Convert Cisco ASA Source/Destination Static NAT

  • February 6, 2024
  • 3 replies
  • 3602 views

hi,

i have a cisco ASA that will convert to FG.

i saw a "NAT trick" configured wherein both the source and destination have a static NAT.

i only know about FG source NAT (SNAT) and destination NAT (DNAT).

how do i configure this in FG? is there a CLI equivalent for this kind of "NAT trick"?

 

nat (inside,outside) source static 10.14.8.5 185.1.2.5 destination static 10.15.0.1 89.25.8.12

 

    3 replies

    AEK
    SuperUser
    AEK
    SuperUser
    February 6, 2024

    Hi John

    Can I ask where such NAT is used or for what can it be useful?

    AEK
      johnlloyd_13
      johnlloyd_13Author
      Explorer III
      February 6, 2024

      hi,

      this link will explain the destination NAT config use case in cisco ASA:

      https://subrun.blogspot.com/2017/08/destination-nat-in-cisco-asa.html

       

      i'll need to migrate this config into FG.

      do you know how to configure this in a FG and achieve the same end result?

      AEK
      SuperUser
      AEK
      SuperUser
      February 6, 2024

      Hi John

      Sorry I thought it was some kind of source NAT and destination NAT at the same time :)

      Actually your document is about destination NAT and here are the different ways to do it on FortiGate:

      https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/728694/policy-with-destination-nat

      AEK
      Peterwilliam123
      Peterwilliam123
      Visitor III
      February 6, 2024

      Hello!
      I hope you will change using these code:

       

      vbnet code
      config firewall address
      edit "source_nat"
      set subnet 10.14.8.5 255.255.255.255
      next
      edit "destination_nat"
      set subnet 10.15.0.1 255.255.255.255
      next
      end

      config firewall policy
      edit 0
      set srcaddr "source_nat"
      set dstaddr "destination_nat"
      set action accept
      next
      end


      This configuration creates two address objects, one for the source NAT and one for the destination NAT. Then, it sets up a firewall policy allowing traffic from the source NAT address to the destination NAT address. Adjust the names and IP addresses as needed for your network setup.
      If it does not change go to the youtube.com see and see in the videos, i hope you will find the best trick.

        Nchandan
        Staff
        Nchandan
        Staff
        February 7, 2024

        Hi John!

         

        The configuration you provided from Cisco ASA involves both source NAT and destination NAT, which can be achieved using VIPs and SNAT policies in FortiOS.

        Here's how you can configure the equivalent of the provided Cisco ASA NAT trick in FortiOS:

        https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143

         

        Hope it helps.

         

          AEK
          SuperUser
          AEK
          SuperUser
          February 7, 2024

          Hi @Nchandan 

          How does it involve SNAT? I see only DNAT here.

          AEK
          Terms & ConditionsAccessibility statement