Skip to main content
botsergeant
botsergeant
New Member
March 22, 2018
Solved

NAT a single IP address through Site to Site VPN

  • March 22, 2018
  • 3 replies
  • 26061 views

Hello all,

 

I am a Fortigate newb.  The only documentation I can find on NAT over site to site IPSEC VPN pertains to versions before 5.6, and only to NATting entire subnets, on both ends. 

 

I have a working IPSEC site to site VPN between my Fortigate (v.5.6) and a remote site (which is using a Cisco ASA.)  I am trying to make ONE host behind the fortigate, 10.0.100.198, appear to the remote site as 192.168.114.6.  Could someone tell me, precisely, what I'm supposed to do to make this happen?  I have experimented with Virtual IPs and IP pools, but nothing seems to work.  It's probably something simple that I'm missing.  If it helps, in Cisco language, this is what I'm trying to accomplish:

 

object-group network external   network-object host X.X.X.X  object network internal   host 10.0.100.198 object network translated_address  host 192.168.114.6   (This is what I want the remote site to see 10.0.100.198 as) nat (inside,outside) 1 source static internal translated_address destination static external external

 

 Thanks!

 

 

Update: I was able to NAT a private address to a static address assigned by my ISP, and hit the web server from outside, through the wan interface:

 

config firewall policy    

edit 5        

set name "Web Server"        

set srcintf "port2"        

set dstintf "port1"        

set srcaddr "all"        

set dstaddr "Public VIP Group"        

set action accept        

set status disable        

set schedule "always"        

set service "ALL"        

set logtraffic all    

next end

 

config firewall vipgrp    

edit "Public VIP Group"        

set interface "port2"        

set member "Public PC VIP"    

next

end

 

config firewall vip    

edit "Public PC VIP"   

set extip 172.216.8.195      

set extintf "port2"        

set mappedip "10.0.100.198"    

next end

 

I just can't figure out how to do this over a site to site IPSEC VPN, using a static IP of my choice (instead of one assigned by my ISP - 172.216.8.195.)   

    Best answer by emnoc

    Okay let me clearified if this is a  rt-base-vpn you need to apply the  "SNAT" address in the vpn tunnel cfg

     

    e.g

     

    config vpn ipsec phase2     edit "YOURTUNNELNAMEHERE"         set keylifeseconds 28000         set src-subnet 192.168.114.6/32    < the  ippool address>         set dst-subnet  x.x.x.x./yy     next end

    3 replies

    emnoc
    emnoc
    New Member
    March 22, 2018

    Just do it in a the fwpolicy and set a  ippool

     

    config firewall ippool     edit "PUBSNAT"         set startip 192.168.114.6         set endip 192.168.114.6     next

    end

     

    config firewall policy

        edit 0         set srcintf "INTERNAL"         set dstintf "RTBASEDVPNTUNNEL"         set srcaddr "MYPRIVATEREALLADRESS"         set dstaddr "THEWANREMOTESUNETADRESS"         set action accept         set schedule "always"         set service "SSH" "HTTPS" PING         set logtraffic all         set nat enable         set ippool enable         set poolname "PUBSNAT"     next

    end

     

     

    Make  sure to use the  SNAT in the phase2- SRCSUBNETS for the proxy-id

    botsergeant
    botsergeantAuthor
    New Member
    March 22, 2018

    emnoc,

     

    Thank you so much for the reply!  I tried your suggestion, but I still have something wrong.  It's probably something foolish that I'm doing.  I do have two policies for the tunnel, as I understand I am supposed to.  I applied the NAT pool to the outgoing tunnel policy, as you suggested.  Do I leave the incoming policy alone (without any NAT?) 

     

    When I initiate the tunnel, the remote site's log shows that it's trying to use 10.0.100.198 to build the tunnel, so it's failing on phase 2 because there is no match.  In other words, it's not trying to use the translated address 192.168.114.6 to try and build the tunnel, like it should.  I'm new to this so forgive me, but I'm not sure exactly what you mean by this:

     

    Make  sure to use the  SNAT in the phase2- SRCSUBNETS for the proxy-id

    Thanks again.

    emnoc
    emnocAnswer
    New Member
    March 23, 2018

    Okay let me clearified if this is a  rt-base-vpn you need to apply the  "SNAT" address in the vpn tunnel cfg

     

    e.g

     

    config vpn ipsec phase2     edit "YOURTUNNELNAMEHERE"         set keylifeseconds 28000         set src-subnet 192.168.114.6/32    < the  ippool address>         set dst-subnet  x.x.x.x./yy     next end

    rahull320
    rahull320
    New Member
    August 5, 2023

    I know this is a very old thread but I have the same requirement using 7.0. Could someone explain how I can accomplish the same using the GUI? I'm new to Fortigate and have not yet learned the intricacies of the CLI.

    aguerriero
    aguerriero
    Explorer
    August 5, 2023

    I would say that you create a VIP with extinf set as any and create a firewall policy that uses the vip as a destination. You might not like it but then you would need to edit the VIP in CLI and do "set nat-source-vip enable"

    Then your ipsec SAs would be the translated/external address for the the real server.

    A diagram would actually help.

    rahull320
    rahull320
    New Member
    August 5, 2023

     

    Hope this image make sense. Left side of diagram is our office. Right side is a remote client and I don't have details of their exact setup.FG to Client VPN NAT.png

    shawinfra
    shawinfra
    New Member
    August 5, 2023

    Well, that is kind of the case. Right now on the Cisco ASA I have maybe 30-40 site-to-site tunnels to/from clients and maybe 5 of them are setup as a NAT on my end due to conflicting/overlapping subnets. I just want to know the best approach of getting this done on the Fortigate as I'm considering of migrating everything over to the fortigate. My network is pretty small, primarily just 8 VM servers and I setup my end as /32 while my client's end can be a subnet of /24 can may or may not overlap my subnet or they request I NAT so it doesn't conflict their end and with other client's/vendors they may have.

    Terms & ConditionsAccessibility statement