SNAT not working on Firewall itself

Question

Hi Guys, I am new to FortiNet family and trying to learn things. I am trying on a FortiGate 300D factory reset box with version 6.2.1. The configuration is simple where I have a VLAN interface which communicates to a Cisco 7201 over private IP address. Since Cisco 7201 does not support NAT, I have to SNAT my source IP to the default gateway (Router). The problem I am facing is that if I try to use FortiGate as a default gateway for internal LAN, everything works fine and I am able to do SNAT just fine. I am just not able to SNAT from the firewall itself. Have tried all sort of possible in/out interface, source/destination addresses. But my trace goes to my default gateway with private IP address without source nat.

FortiGate-300D # diag sniffer packet any 'host 1.1.1.1 and icmp' 4
interfaces=[any]
filters=[host 1.1.1.1 and icmp]
7.084324 wan out 10.99.99.39 -> 1.1.1.1: icmp: echo request
7.084326 port2 out 10.99.99.39 -> 1.1.1.1: icmp: echo request

Where as if I try to ping public IP from my LAN, SNAT works fine

FortiGate-300D # diag sniffer packet any 'host 1.1.1.1 and icmp' 4
interfaces=[any]
filters=[host 1.1.1.1 and icmp]
1.212742 vlan-101 in 10.2.20.100 -> 1.1.1.1: icmp: echo request
1.212876 wan out 103.83.89.39 -> 1.1.1.1: icmp: echo request
1.212878 port2 out 103.83.89.39 -> 1.1.1.1: icmp: echo request
1.237508 wan in 1.1.1.1 -> 103.83.89.39: icmp: echo reply
1.237516 vlan-101 out 1.1.1.1 -> 10.2.20.100: icmp: echo reply
1.237518 port1 out 1.1.1.1 -> 10.2.20.100: icmp: echo reply

This is my current SNAT policy which works for LAN only,

config firewall central-snat-map
    edit 1
        set orig-addr "vlan-101 address"
        set srcintf "vlan-101"
        set dst-addr "all"
        set dstintf "wan"
        set nat-ippool "103.83.89.39"
    next
end

And I can't seem to figure out why the firewall itself not able to SNAT for it's source IP. :S

ede_pfau · Accepted Answer

I agree it would be elegant to treat FGT's own traffic ('local') identically to other traffic. But, this is not the case.

FortiOS has a (obscure) algorithm to attach one of it's interface addresses to local outbound traffic - which sometimes results in funny traceroute output. Over the years FTNT has realized that sometimes local outbound traffic needs to have a specific source address.

So for local outbound services you may (for the most part) set a 'source-ip' in the CLI where the service is configured. FortiAnalyzer traffic, ping, FMgr come to my mind. For example, in the CLI type

'exec ping-option source 1.2.3.4' and then 'exec ping 9.9.9.10', and in the sniffer output you will see that SNAT is effective. Of course, the source IP needs to come from one of the 'connected' networks, so that routing can take place.

If you want to find all places where you can 'set source-ip', do

'show full | grep -f source-ip'.

Andreas77_FTNT · Answer

Hi,

From where is this echo request packet being sent :

7.084324 wan out 10.99.99.39 -> 1.1.1.1: icmp: echo request If this is from the FGT itself using ping command ?

If so, this is local traffic and I'm afraid you cannot use SNAT on that.

Sign up

Login with SSO

Login to the community

Login with SSO