Skip to main content
ping
ping
New Member
February 9, 2016
Question

Destination NAT

  • February 9, 2016
  • 1 reply
  • 13375 views

Hi,

I am new to the Foritgate systems. We just purchased a 92D that replaced a old Check Point firewall. I want to translate the policy and nat configuration from Check Point to Fortigate.  What is the best way to write this Nat rules on Fortigate?   <---------------Original Packet---------------><-----------Translated Packet------------>   <---Source---><---Dest---><----Service---><---Source---><---Dest---><----Service---> 1-        any            2.2.2.2            80                   Original          3.3.3.3        8080 2-        any            2.2.2.2            any                  Original          3.3.3.3        any     I have done some test with VIP configurations but I don't found the way to insert the second configuration line. When I insert the second VIP I receive this error: "A duplicate entry already exists."

Can you give me some tips/advice on how to configure this NAT?

Thanks.

1 reply

tclark
tclark
New Member
March 3, 2016

You will need to specify non-overlapping ports if you want to forward 80 to 8080.

 

config firewall vip
edit "Test1"
set extip 2.2.2.2
set extintf "wan1"
set portforward enable
set mappedip "3.3.3.3"
set extport 80
set mappedport 8080
next
edit "Test2"
set extip 2.2.2.2
set extintf "wan1"
set portforward enable
set mappedip "3.3.3.3"
set extport 1-79
set mappedport 1-79
next
edit "Test3"
set extip 2.2.2.2
set extintf "wan1"
set portforward enable
set mappedip "3.3.3.3"
set extport 81-65535
set mappedport 81-65535
next
end

 

Make sense?

ping
pingAuthor
New Member
March 3, 2016

Yes, I used this workaround . But you must consider that in my example I used "service=any" that it means all protocols (tcp , udp and icmp). In your declaration you use only tcp protocol. If you want to consider all protocols I think that you must define a VIP Group that contains these definitions : <---Source---><---Dest---><----Service------> <---Source---><---Dest---><----Service---> 1- any               2.2.2.2          tcp:80                Original           3.3.3.3         tcp:8080 2- any               2.2.2.2          tcp:1-79             Original           3.3.3.3         tcp:1-79 3- any               2.2.2.2          tcp:80-65535      Original           3.3.3.3         tcp:80-65535 4- any               2.2.2.2          udp:any              Original           3.3.3.3         udp:any 5- any               2.2.2.2          icmp                   Original           3.3.3.3         icmp

Than you can use this VIP Group on the policy (in the destination address section).

For now, I have found only this solution.

ede_pfau
SuperUser
ede_pfau
SuperUser
March 4, 2016

set protocol icmp
is new in v5.2 and (finally) allows testing NATted servers with ping. As ICMP is a portless protocol it couldn't get across port-forwarding VIPs in the past.

 

@ping: the way to go. Except for creating the 5 VIPs, not so much hassle. One could argue if the implicit port-overlap which is allowed with Checkpoint isn't a potential security risk...

Terms & ConditionsAccessibility statement