Skip to main content
shaan129
shaan129
New Member
November 13, 2019
Question

Double_NAT

  • November 13, 2019
  • 2 replies
  • 4796 views
Dear All , Need your help , expertise on the below issue Server 1 is in LAN behind the Fortigate 60 FW both share ip address from the same subnet , GW for the server 1 is ip of the Fortigate . Fortigate is connected to a Cisco Router (handled by different vendor) & on its LAN there is a Server 2 whose gateway is one of the interface of the cisco router . Now i am trying to communicate Server 1 with Server 2 and vice versa but issue is server 1 before communicating or exiting the Fortigate interface should changed its ip address to a different ip address . Now i have done the test and i am able to ping to ping the server 2 from server 1 but when i do the same from server 2 to server ping not responding & traceroute reaches until ip of the Fortigate ip which is connected to the Cisco router and nothing after that . I have attached diagram for better understanding , kindly help with your inputs Regards shaan

    2 replies

    Dave_Hall
    Dave_Hall
    New Member
    November 13, 2019

    If the path of server 2 traffic is hitting the WAN port(s) of the Fortigate then you likely need to set up a VIP (port forward); if both LANs on each side of the fgt are connecting via an internal port, you may need to define a route to 192.168.255.254/32 directly.  However, I don't think this is actually needed.  I suggest checking the return firewall policy (from server2 to server1) - you will need two firewall rules for both directions of that fgt connection. Perhaps post a screenshot (san identifiable IP info) here.

    sw2090
    SuperUser
    sw2090
    SuperUser
    November 14, 2019

    are you sure the cisco does nat server2 back to the FortiGate?

    If traffic reaches the FGT with the original IP of server2 there will be no answer because the FGT doesn't know that subnet nor has a route to it.

     

    emnoc
    emnoc
    New Member
    November 14, 2019

    I do not think you need to do anything but check for route to the src-address that server1 is SNAT to. What does diag sniffer packet show and the src_address that enters the  Fortigate ?

     

     

    shaan129
    shaan129Author
    New Member
    November 16, 2019

    Dear All ,

     

    I have the source route in place ... from Fortigate interface connecting to Cisco router i cna ping the server 2 and i am able to get the response as well only issue with NATing i guess and i got below response from the router team who is managing the Cisco router 

     

    I captured the logs from the continuous ping done earlier and it looks like the traffic initiated from the server1 (192.168.255.254) is being NATed to the 10.249.107.98 (instead of 10.249.107.80 IP) before coming to the cisco router.

     

    This is why when you try to ping the 10.249.107.80 from the server 2(10.249.104.x) it is not working as that NAT (192.168.255.254 - 10.249.107.80 ) is not working.

     

     

    Regards

    shaan

     

     

    Terms & ConditionsAccessibility statement