Outgoing NAT on two interfaces

7 replies
5076 views

I have a quite complicated network setup with multiple interfaces. However, for the problem I want to describe the setup can be simplified to three interfaces: wan1, dmz1 and internal1. Hosts connected to dmz1 have public IP addresses and NAT is not used. Hosts connected to internal1 have private IP addresses and I want to use NAT on outgoing connections both to wan1 and to dmz1. And this does not work for me. Wan1 is 149.156.6.58/30, dmz1 is 149.156.24.1/27, internal1 is 10.200.0.1/16. I want the NATed IP address on outgoing connections to be visible as 149.156.24.6, on both interfaces. So I defined two IP pools, both containing the single address 149.156.24.6, one bound to interface wan1 and the other to dmz1. When I activate NAT with the above IP pool on interface wan1, it works OK. I can connect to the Internet and connections are coming from 149.156.24.6. However, I can' t get the same on interface dmz1. The connections simply don' t work, I get no response to pings. When I use NAT without any IP pool on dmz1, it works and I see the connections coming from 149.156.24.1 - but that' s not what I want. I want the same address to be used on connections to both interfaces. Do you know how to handle this problem? My device is Fortigate-200A with FortiOS 3.00-b0744(MR7 Patch 6)

emnoc

New Member

May I ask why do you need the same ip_address ? I' ve tried this before with 2 defined pool but using the same address. You will never get this to work. The 1st defined pool is what bounds that ip_address and interface. What I did was just use 2 ip-address and create a pool1 and pool2, pool1 cover all outbound NAT ( WAN ) and any traffic to the DMZ was bounded to pool2.

rwpatterson

New Member

All IP addresses from my 1000A are the same, and I only have one IP pool for outgoing (mail servers excluded). Don' t know if things work differently when your interfaces are only labeled ' port 1' - ' port 10' ...

red_adair

New Member

humble Question: If a Packet can leave 2 Interfaces with the same IP, how can the reply packets do the Trick ? Magic Routing ? -R.

A

Anonymous_UserAuthor

Esteemed Contributor III

I don' t understand what' s the problem with the reply packets. What the routing tables are for at all, actually? You have a router with three interfaces, connecting three networks. A packet is coming from interface internal1, source IP gets translated to some address X, that in my case belongs to the address space connected to interface dmz2, and goes out either via dmz2 or wan2. There is no problem with reply packets from dmz2 - the address X belongs to that network, so all that is needed is that the router responds to ARP requests for this address. As for wan2, since we have a working routing between wan2 and dmz2, the routers in wan2 network know that our router is the gateway to dmz2 address space, including address X. So if they see packets addressed to X, they send them to our router. It recognizes that X is the address it is using for NAT, so it just translates the address back and sends them to the originating host on internal1. Imagine there is no NAT at all and network on internal1 has public IP addresses. Then a packet coming from internal1 can go out on either dmz2 or wan2 - depending on which network it is addressed to - and has the same source IP in both cases. Will there be any problem with reply packets in that case? Using the same address for outgoing NAT on both interfaces just simulates this situation.

emnoc

New Member

Will if you get it working, please update this thread? I have about 3 FGT that I would like to consolidate down to one ip-address pool and in the same situtation as what you have going.

A

Anonymous_UserAuthor

Esteemed Contributor III

I wrote it already above - I got it working when I added the address I want to NAT to as a secondary IP address on the interface where it wasn' t working. The only catch is that it is needed to enable " subnet overlapping" from CLI before you can add a secondary IP address from the same subnet that is already defined on the interface: config system settings set allow-subnet-overlap end (the above command is valid for FortiOS 3.0 MR7, for previous versions the command is a bit different, as I found from Fortigate documentation: config system global set allow-interface-subnet-overlap end)

Sign up

Login with SSO

Login to the community

Login with SSO