Migration of NAT/PAT rules from a Cisco ASA to a FortiGate FGT 40

Here is an example of how FortiConverter handles converting the ASA NAT to the FortiGate NAT.
https://docs.fortinet.com/document/forticonverter/7.0.4/online-help/115689/cisco-pix-and-asa-nat-merge-examples
Hope this shines some more light on your question. If there is a specific query, let me know.

Hi @IT_ZD,

FortiGate has 2 NAT modes. Not sure which one you are using? Please check https://docs.fortinet.com/document/forticonverter-service/23.1.0/online-help/924520/policy-nat-vs-central-nat-mode

Regards, 

Hello Hbac,

Thank you for your return.

1- Should I add a new policies for the network source and destination by activating NAT/PAT?

2- Or activate NAT/PAT on already configured policies

3- Or not apply it to policies

Regards.

Greetings,

First of all, are you using policy NAT or Central NAT?

There are 2 NAT modes in FortiGate: policy NAT mode and central NAT mode. Policy NAT mode requires NATs to be configured inside firewall policies, which is the default mode that FortiGate uses. Central NAT mode separates NATs and policies into 2 independent modules so policies do not reference NAT objects.

If you use policy NAT, then enable the NAT in the firewall policy, like shown in this document: https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/898655/static-snat

If you are using central NAT, then you have to create a separate rule for NAT, like https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/421028/central-snat

Policy NAT is the simplest way to achieve NATting. Simply enable the NAT in the firewall policy, no need to configure additional NAT policies. 

Select either way, it depends on the requirement. 

Regards!

If you have found a solution, please like and accept it to make it easily accessible to others.