Setup NAT to Web Server with SD-Wan Interface

8 replies
6127 views

Hi guys,

What is the right procedure when creating NAT to my web server. should be accessible outside using a public ip of the same subnet as my wan interface. i am using sd-wan interface. thank you in advance.

AEKAnswer

SuperUser

Yes you need a firewall policy, like this:

srcintf: e.g.: WAN
dstintf: e.g.: DMZ
src: ALL (or some public IP, or some GeoIP)
dst: VIP_object
service: HTTPS or other
UTM: any security you need

AEK

bpozdena_FTNT

Staff

DNAT on Fortigate is configured using Virtual IPs. It's exactly the same with or without SDWAN.

See the below documentation for more details:
https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/728694/destination-nat

kish02Author

New Member

Sorry for the late response, got busy with other matters. Once i have configured the virtual ip, do i need to create a firewall policy?

VIP setup

Type: Static Nat
External IP: Wan1 public ip(i have other static ip aside from what is set on wan1 interface)

Map to: Local test server

I have searched for DNAT procedures online and they created firewall policy as well.

AEKAnswer

SuperUser

Yes you need a firewall policy, like this:

srcintf: e.g.: WAN
dstintf: e.g.: DMZ
src: ALL (or some public IP, or some GeoIP)
dst: VIP_object
service: HTTPS or other
UTM: any security you need

AEK

SuperUser

Hi @kish02

When configuring DNAT, you can either use the WAN interface's IP or use another public IP (if your ISP has provided you with extra public IP addresses).

AEK