How to view off site cameras via a browser

Hi, and welcome to the forums. What you are planning can be done with the help of Virtual IPs. For each camera, create one VIP as follows: go to Firewall>Virtual IP>Virtual IP Create New name: camera01 External interface: WAN (whatever it' s called with your FGT) Type: Static NAT External IP: <your public IP address, e.g. 10.10.10.1) Mapped IP: 192.168.90.1 (for example) Port Forwarding: enable Protocol: TCP External Service Port: 9001 Map to Port: 80 (for HTTP) or 443 (for HTTPS) Create all VIPs you need, one for each camera. You cannot use an external port number twice. All other parameters can be used multiple times (e.g. the one public IP address). Now, create a VIP Group (just below in the GUI). This will make your life easier. Then, use the VIP group in a policy: Firewall>Policy>Policy Create New WAN -> internal source addr: all dest addr: <the VIP group> service: HTTP or HTTPS schedule: you might restrict access by time of day, ' always' otherwise action: ACCEPT NAT: no Now try to reach a camera via browser. Note that you cannot ping it. For security I would strongly recommend you put a login page on the access policy. In Fortigates it' s called ' Identity Based Policy' . This way, you authenticate in the browser prior to accessing any camera (but only for the first camera). Cookbook is OK, get the FortiOS Handbook as well if you haven' t already. If you need more hints, you' re welcome.

Thank you both for your help. Is this a case where I' d want to use " Transparent" mode?

Nice post, if only more people would take the effort to do that...life would be too easy then. What I see from the diagram is that the cable modem is a router - it' s got 2 interfaces in different subnets. So NAT with port forwarding must be done at the modem' s WAN port. After that, you can only deal with private IP addresses (192.168.x.x) which you can' t address from the internet. So, in short, the FGT must be your edge device in order to work with VIPs. What you could do (and what I do often with a modem setup) is that you switch the cable modem into ' bridging mode' and let the FGT be the gateway. I don' t know the details of the cable interface but I guess you configure the FGT' s WAN interface for DHCP or PPPoE, provide the credentials and let it connect through the modem. Then you can use the VIPs like posted above. In the incoming policy WAN->internal, you specify your unique remote IP address (172.x.x.x) as source address to narrow down access. From a security point of view, Identity based policy would be much better. And it ain' t complicated at all. So maybe someone else from the U.S. can give you more advice how to let the FGT handle the handshake with your cable provider. Access to the modem' s configuration is required in any case, either for switching it into bridging mode or for port NAT, so that' s crucial.

Thanks again Ede, I have it working. I could not get the cable modem in a bridging mode. So I ended up doing a double port forward. Modem ->FGT ->Cameras

you' re welcome, I' m glad it' s working now. Many roads lead to Rome...