ONE to One NAT

4 replies
6768 views

Hi,

I am using Fortigate 101 E firewall.Actually I want to do one to one NAT and already got few public IPs from ISP. Now the problem is these Public IPs are in different range than WAN IP through which all internal devices accessing internet.My question is, Can we do One to One NAT even we have diffrent public ip range?

Thanks !!

Toshi_Esumi

SuperUser

Not a problem. It's very common while an interface IP is x.x.x.x/30 the additional subnet is y.y.y.0/29 or something like that. ISP delivers packets destined to the /29 to your x.x.x.x interface. Your FGT can pick them up and do VIP with static NAT for each /29 IP to individual internal device. And you can do the opposite direction with an ippool per IP and set SNAT.

ede_pfau

SuperUser

@Toshi: ...or rely on the automatic re-translation for outbound traffic through that VIP. Just test it, you'll see what I mean. No need for an extra policy with an IP pool.

Toshi_Esumi

SuperUser

I thought it would automatically work only for returning packets based on the sessions initiated with the out-to-in direction packets. And if the inside servers initiate new sessions toward the internet, those packets would have the interface IP for their source instead of VIP inside IPs unlike Cisco's static NAT, unless it's using Central NAT.

Sign up

Login with SSO

Login to the community

Login with SSO