Setting up a Dual NAT

hi,

and welcome to the forums!

You'll find plenty of fellows here just starting into the Fortinet world so no need to apologize (except maybe for using SRXes...). Your plan sounds interesting, and is easy as pie to set up.

First off, to put the FGT at front towards your ISP is a wise decision. It needs a routable public address on it's WAN port, for authenticating against the FortiGuard servers for continuous UTM signature updates (and much more other stuff). So, I was relieved to see this.

Now the steps to set it up:

1- the FGT is configured to autheticate against your ISP via the 'wan1' port - DHCP, PPPoE, static address, whatever.

2- you make sure there is a default route pointing to the ISP's gateway (that is, destination '0.0.0.0/0'). DHCP and PPPoE deliver this automatically.

3- the internal ports only cater for a 'transfer net'. Any private address range will do, so like 172.16.x.1/24 or 192.168.x.1/24. This will be the (static) address of the 'internal' port(s). There is room for 253 other addresses but you will only need one other.

4- to make things easy configure a DHCP server on port 'internal' if it doesn't exist yet. This will assign a valid address, the gateway, the DNS and even the NTP server address if you like, to any host connecting to the 'internal' port and using DHCP requests.

In your case, this host will be the home router, more specifically, it's WAN port. Configure it to use DHCP.

5- Where is the double NAT? In the policy!

So now you create a policy on the FGT, from 'internal' to 'wan1', addresses 'all' to 'all', service 'ANY', NAT enabled, UTM enabled (at least AV). This will do the private transfer net-to-public NAT. Your home router will do the second NAT plus the Upnp stuff, like before.

So, in short, remember that in order to have traffic flowing across the FGT it needs

- both a route to the source and to the destination

- a policy connecting the inbound and outbound ports

Look up the current routes in Monitor/Routing. The FGT automatically creates a route for each subnet which is directly connected to one of it's ports. And for unknown destinations, there is the default route.

Your home router gets his gateway address through DHCP from the FGT - it's the address of the 'internal' port.

As the home router is NATting, the FGT doesn't need to know your true internal address space behind the home router.

This description seems a bit bloated, I apologize. I wanted to make sure you get it right the first time. The setup will take you less time than needed to read this. If you encounter any problems let us know.