Migrate Cisco ASA to FortiGate

You do not need a conversion tool in order to do NAT. Look at each NAT and apply it a central-NAT or  per-policy as required. The concept are equally the same between ciscoASA and FortiOS

 

 

 

#  DNAT rules cisco ASA

 

object network webserverdnat

 

 host 172.7.72.11

 

nat (inside,outside) static 1.0.0.111

 

 

# DNAT VIP  FGT port-forward tcp80

 

config firewall vip

 

edit webserverdnat

 

set comment "DANT TO rfc1918"

 

set extintf wan1

 

set extip 1.0.0.111

 

set mappedip 172.7.72.11

 

set portforward enable

 

set protocol tcp

 

set extport 80

 

set mapped port 80

 

end

 

 

# DNAT VIP  FGT 

 

config firewall vip

 

edit webserverdnat

 

set comment "DANT TO rfc1918"

 

set extintf wan1

 

set extip 1.0.0.111

 

set mappedip 172.7.72.11

 

end

 

 

 

 

# cisco DNAT port forward

 

object network WebServerCH3-LAMPSRV01

 

host 172.7.88.101

 

nat (inside,outside) static 1.0.0.1 service tcp 80 80

 

!

 

 

# cisco pat overload to a pool 

 

object network MYLAN

 

subnet 172.254.12.0. 255.255.255.0

 

object network SNATPOOL

 

subnet  192.0.2.1 255.255.255.255

 

nat (inside,outside) 1 source static MYLAN MYLAN destination static SNATPOOL SNATPOOL

 

 

#FortiOS CENTRAL-NAT

 

 

config firewall ippool

   edit publicpoolA

          set type overload

          set startip 192.0.2.1

          set endip   192.0.2.1

   end

 

config firewall central-snat-map

edit 1

  set orig-addr <pre-nat.src.addr>

  set dst-addr <pre-nat dst.addr>

  set nat-ippool ippool publicpoolA

end

 

 

That a few examples I can think of, just determine if you want central-net or nat within the policy.

 

Thank of central net the same as ciscoASA, Palo,Juniper,CHKP,Forcepoint NAT-tables.

 

YMMV but both are equally beneficial and easy  concepts to figure out.

 

Ken Felix