Destination NAT

Question

I am in the process of transitioning from a Cisco ASA to a Fortigate FW. A new requirement is to use destination NAT in an effort to cut down on address space usage. I am unsure of the destination NAT process on the Fortigate, so hoping this forum may help. The design is to have a private network between our router and Fortigate FW (outside interface) and another private network on the inside interface. I would like to NAT a public address space on the Fortigate to the inside private network. Do I need an interface on the Fortigate with that public address space or can the Fortigate perform destination NAT for the public address space to the inside private space without having an interface on the public network. Hope this makes sense

- Matt

ede_pfau · Answer

Yes, that is possible.Viewing from the FGT, it is not important if a public WAN address is forwarded to an internal private address, using DNAT, or a private WAN address is forwarded. The process is the same. Only the routing is different (easier). Let'z assume: public/ISP router 1.1.1.1/28         i.e. public usable addresses .3 to .14 | | 1.1.1.2 your WAN router 10.10.10.1/28    (at least as big as the public subnet) | | 10.10.10.2 your FGT 192.168.10.1/24 | | 192.168.10.99 LAN server goal: map 1.1.1.3 to internal 192.168.10.99steps:1- your WAN router DNATs 1.1.1.3 to 10.10.10.32- your FGT DNATs 10.10.10.3 to 192.168.10.99for this, create a VIP (virtual IP) with external address=10.10.10.3, mapped-to address=192.168.10.99anda policy from WAN to LAN, source addr=all, dest addr=VIP routing:on LAN server: default route=192.168.10.1 (your FGT)on your FGT: default route=10.10.10.1 (your WAN router)on your WAN router: default route=1.1.1.1 (your ISP router) On the way in, traffic is NATted twice - only the destination address is exchanged, the source address is kept. On the way out, traffic is NATted twice again: but this time source NAT!On the FGT, the VIP will do this automatically if you do not port forward. (actually, it doesn't matter if you apply SNAT here, as your router is not a security device and will not drop traffic from unknown source networks (I hope)).On your router, you will need to create a source NAT (as always; the public egress interface IP will do). The destination address will be kept. You see, it's that simple. Only your router inbetween will take special treatment. But as you know Cisco equipment, this should be easy...

Sign up

Login with SSO

Login to the community

Login with SSO