Juniper to Fortigate: Confusion Regarding Juniper MIP and VIP alternative in Fortinet

In the middle policy above, did you mean to say VIP instead of MIP?  Otherwise I don't see any use of the VIP in the Juniper config.

Anyway, I'm not familiar with Juniper personally, but it looks to me like VIPs are VIPs in both worlds (though of course there may be subtle differences).  MIPs appear to be IP Pools in the FortiGate world.  However, unless you're doing central NAT you don't specify the internal address at all.  On the FortiGate IP Pool you would just define the external IP, and then use that IP Pool when programming what NAT to use for the specific outbound policy.

Hope this helps.  There is tons of documentation on FortiGate's site, especially their cookbooks that might be helpful to you.  https://cookbook.fortinet.com/

- Daniel

noorani92 wrote:

What is the alternative for MIP and VIP of Juniper in Fortigate? Following is one of our configuration in juniper

MIP

Mapped IP:172.16.5.132

Host IP:192.168.5.21

Netmask:255.255.255.255

 

and for the same public IP there is a VIP configuration

IP Address:172.16.5.132

Virtual Port:80

Service Port:80

Server IP:192.168.5.21

In the Fortigate world, all of this is configured in the Virtual IP definition. An inbound policy would simply allow/deny access to the internal server in one step. You simply use the VIP definition as the target of the policy with the associated service(s) of course. The example you provided would be referred to as a 'Port Forwarding' Virtual IP. You may also map all ports to an IP address if you have the availability. This option will send ICMP traffic to the internal host as well, while a port forward will not.

Hope that helps a bit.