Help with Fortigate DNAT Configuration

Hi.

I guess config will look like below:

------------

config firewall vip
  edit "vip_DNAT-8080-3389"
    set extip 172.17.200.200
    set mappedip "172.17.200.200"
    set extintf "Interface_v999" ※Your external interface
    set portforward enable
    set extport 8080
    set mappedport 3389
  next
end

------------

@jasusu 
Please note that in FortiGate you can not create NAT using the same external and mapped IP.

Even from CLI you will get the same warning:

FGT # config firewall vip
FGT (vip) # edit 1
new entry '1' added

FGT (1) # set extip 172.17.200.200

FGT (1) # set mappedip 172.17.200.200

FGT (1) # set portforward en

FGT (1) # set extport 8080

FGT (1) # set mappedport 3389

FGT (1) # set extintf port1

FGT (1) # next
Static NAT's extip should be different from mappedip.
object check operator error, -8, discard the setting
Command fail. Return code 1

FGT (vip) #

In this case what you can do is as per below:
1. Enable Load Balancing

config system settings
set gui-load-balance enable
end

2. Configure virtual server

config firewall vip
edit "TEST"
set type server-load-balance
set server-type tcp
set extip 172.17.200.200
set extintf "any"
set extport 8080
config realservers
edit 1
set ip 172.17.200.200
set port 3389
next
end
next
end

3. Configure Firewall policy to match this traffic

config firewall policy
edit 1
set name "VIP-Access"
set srcintf "port1"   ---- Incoming port
set dstintf "port2"   ---- Outgoing port
set action accept
set srcaddr "all"
set dstaddr "TEST"   ---- The name of VIP you created above
set schedule "always"
set service "ALL"
next
end

Please note that incoming port and outgoing port might be the same, depending on your network topology.

Hope this helps.