Skip to main content
vajny
vajny
Visitor III
January 26, 2022
Question

Multiple wan ip and nat based on port and destination ip.

  • January 26, 2022
  • 1 reply
  • 3223 views

Hi,

I am new to fortigate, but I am getting one tomorrow and I would like to configure to work like this.

 

I have 5 public ips from my ISP, basically my router is in bridge mode and all the traffic will go to fortigate.

Behind fortigate will be 10 network devices for which I want to port forward traffic based on destination ip and port.

 

For example i will have public IPs 1.1.1.1 1.1.1.2 etc.. 

private ips 10.10.10.1  10.10.10.2 etc..

if i want to access port 80 on 10.10.10.1 I will go to 1.1.1.1:80 or domain with A type record in dns to this ip but also when I want to access 10.10.10.1:88 I need to be able to go from 1.1.1.2:88

and from  1.1.1.2:98 to 10.10.10.1:60.

 

I know to to do this config in mikrotik, but I dont have option to use it in this place since they have one spare fortigate.

 

Is there simple way to do this? And if is, which is the simplest bulletproof way? Also if there would be option that 1.1.1.1 would not be able to access 1.1.1.2 that would be also cool.

1 reply

AlexC-FTNT
Staff
AlexC-FTNT
Staff
January 27, 2022

 "my router is in bridge mode and all the traffic will go to fortigate"

>> make sure first that all the assigned public IPs are correctly forwarded to the FortiGate (all of them) 

Maybe not clear the explanation of what you try to achieve.

If your goal is this

1.1.1.1:80 >> 10.10.10.1:80 (VIP1)
1.1.1.1:88 >> 10.10.10.1:88 (VIP2) (can be in a group with VIP1)

1.1.1.1:98 >> 10.10.10.1:60 (VIP3) (can be in the same group with VIP1)

1.1.1.2:80 >> 10.10.10.2:80 (VIP4)

.....
This is done with VIP and port forwarding (access from Internet).
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143
Both external and mapped ports can be configured (not fixed to the same number 80 > 80)

You also need an IPv4 policy to allow the traffic from wan > internal, from all (or filtered) sources to the VIP address object or group.

    Terms & ConditionsAccessibility statement