Skip to main content
alexm3
alexm3
New Member
November 3, 2021
Solved

NAT from one computer to another

  • November 3, 2021
  • 2 replies
  • 17211 views

Good afternoon! 

 

I am a networking rookie currently working with a Fortigate 80F, and am trying to understand how NAT works. I have two computers connected to the router with static IP addresses of 192.168.1.1 (PC1) and 192.168.1.101 (PC2). I am looking to set something basic up in which I can ping a virtual IP address (let's say 192.168.50.1) on PC1, and this will translate to PC2's IP address and get a reply back from PC2. I set up a Virtual IP to do this on PC1, and still have all interfaces on the hardware switch. I didn't get any response from the ping. I also added an IPv4 policy to allow traffic from the internal switch through that pings the VIP, but this also didn't work. Am I missing something here? I'm confused as to why this isn't working. I would really appreciate any insights anyone can provide!

Best answer by Toshi_Esumi

You should try two PCs on two different interfaces. I don't know if an 80F has hard-switch like "internal" to combine all LAN ports. But if so, you should break them into individual ports like internal1 and internal2. Then assign different subnets to each interface and connect a PC to one port.

So that it's easy to understand what is external interface what is internal in terms of VIP, which is described at cookbooks and other documents.

2 replies

Toshi_Esumi
SuperUser
Toshi_EsumiAnswer
SuperUser
November 3, 2021

You should try two PCs on two different interfaces. I don't know if an 80F has hard-switch like "internal" to combine all LAN ports. But if so, you should break them into individual ports like internal1 and internal2. Then assign different subnets to each interface and connect a PC to one port.

So that it's easy to understand what is external interface what is internal in terms of VIP, which is described at cookbooks and other documents.

alexm3
alexm3Author
New Member
November 4, 2021

Thanks for your helpful reply! I am still having some trouble unfortunately. I did what you said and removed interface3 and interface4 from the hardware switch and gave them their own subnets (192.168.2.0/24 and 192.168.3.0/24 respectively). I was using the following post to try and do my NATing:

https://forum.fortinet.com/tm.aspx?m=136309

 

I followed that post exactly, just using internal on both sides instead of having a side that faced the internet, and am still having no luck. Would the NATing still look like the above post when you have two private IP address on both the internal and external sides? Or does this require something different?

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
November 4, 2021

My guess is you didn't set a set of policies right. CLI is easier to examine. Get in CLI via console, ssh, or CLI on GUI. Then,

  config firewall policy

  show | grep -f interface3 (I'm not sure this is the correct interface name. 60F has internal1, internal2, ...)

Then show us the pair of policies you created in GUI.

alexm3
alexm3Author
New Member
November 8, 2021

Here is the policy I created for the router. The idea here is to use NAT to communicate to another PC using a simple routed address. I realize this structure may not make sense, as the computers could communicate already given their IP addresses, but I wanted to use this as a learning exercise. If it helps, here is the diagram of what I am trying to do:

I really appreciate any help you can give me! Thank you so much in advance

Terms & ConditionsAccessibility statement