Skip to main content
Peddy1976
Peddy1976
Visitor III
May 31, 2022
Question

IP Pool: How to achieve port translation?

  • May 31, 2022
  • 3 replies
  • 7133 views

Hi all,

 

I've a doubt. I'm readying on how the IP pool with overload option should works. Documentation says that it should perform port translation but as I see from my logs the source port and the translated source port are always the same. 

 

The IP pool contains only one IP.

 

Platform: Fortigate300D

FortiOS: 6.0.12

 

Many thanks,

Maurizio

3 replies

jintrah_FTNT
Staff
jintrah_FTNT
Staff
June 1, 2022

Hi,

 

Is there any benefit changing the source port? Please share the document which you are referring to.

 

Best regards,

Jin

Peddy1976
Peddy1976Author
Visitor III
June 1, 2022

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/29961/dynamic-snat 

 

Here is the document I am referring to.

jintrah_FTNT
Staff
jintrah_FTNT
Staff
June 1, 2022

Thanks to share the article, it does not specifically mention that port would be translated always, indeed it mentions about the number of available ports per ip for NAT overload. I agree with Adrian that the source port would be changed when multiple sources uses the same source port to same destination to avoid conflict/clash in outbound sessions considering 5 tuple.  But using any/same source port does not hinder the session otherwise, and generally a dont care value. However, on occasions where source port is to be retained as it is and should be ensured that they are not altered when NAT overloaded, an option provided here is to use 'preserve source port'.

 

Best regards,

Jin 

 

akristof
Staff
akristof
Staff
June 1, 2022

Hi,

Source port will not always be translated. If there are low amount of sessions, there is high chance that the port will be the same. If you connect from 2 different sources with same ports, then you will see translated port.

    Peddy1976
    Peddy1976Author
    Visitor III
    June 1, 2022

    Hi Adrian, thanks for the explanation. I didn't find this in the documentation related to NAT overload.

    pminarik
    Staff
    pminarik
    Staff
    June 1, 2022

    Perhaps the missing detail you are looking for is that in overload IP-pool scenario (and also in the default SNAT over outgoing interface IP), the FortiGate will try to preserve the source port if possible. It will only change if it needs to do it to avoid a session clash.

     

    The first device trying to use source-port 54321 will be source-NATed to the same source port as long as it is not used. A second device initiating a session with the same source-port will be source-NATed to a different source port.

     

    This can be verified with a bit of python scripting:

    import socket as sock
    s = sock.socket(sock.AF_INET, sock.SOCK_STREAM)
    s.bind(("0.0.0.0", 54321) # explicitly request source port 54321 from OS)
    s.connect(("93.184.216.34", 80)) # IP for www.example.com
    # stop and check debugs now
    s.close() # to close the session/socket

    -> Now run the script (without doing "s.close()" yet) on two clients, and check how the sessions get source-NATed.

     

    The resulting NAT situation can be checked in FortiOS CLI with "get sys session list":

    # get sys session list | grep 93.184.216.34
    tcp 3598 10.19.5.147:54321 192.0.2.22:25738 93.184.216.34:80 -
    tcp 3569 10.109.62.30:54321 192.0.2.22:54321 93.184.216.34:80 -
    # note: Columns are: protocol | expiration time | source | source-NAT | destination | destination-NAT

     

    Explanation:

    Client 10.109.62.30 was the first to initiate a connection with source-port 54321 (it has shorter expiry time). You can see that the source-port is preserved post-SNAT in this case.

    Client 10.19.5.147 was the second to initiate a connection with the same source-port 54321 to the same destination IP+port (important!), and as you can see the source-NAT port was moved because of it. (already "taken" by the first client)

     

      Terms & ConditionsAccessibility statement