Static DNAT to an Mapped IP Subnet

Forum|Forum|11 months ago
August 20, 2025
2 replies
440 views

hi,

i need to convert the ASA static NAT on a subnet to FortiGate.

the FGT GUI doesn't allow me to add/configure a LAN subnet.

just wondering how to implement this?

do i configure individual LAN/mapped IP in a VIP, add to a VIP group to the same external/public IP?

can i also configure the same external/public IP for both DNAT and SNAT? does FGT allow this?

ASA:

object network obj_LAN_SUBNET
subnet 172.16.1.0 255.255.255.0
nat (inside,outside) static 89.1.1.1

FGT:

config firewall vip

edit "lan-vip-1"
set extip 89.1.1.1
set mappedip 172.16.1.1
set extintf "any"
end

edit "lan-vip-2"
set extip 89.1.1.1
set mappedip 172.16.1.2
set extintf "any"
end

config firewall vipgrp

edit "lan-vip-group"
set interface "any"
set member "lan-vip-1" "lan-vip-2"

edit DNAT 1
set srcintf "port 1" <<< WAN
set dstintf "port 2" <<< LAN
set srcaddr "all"
set dstaddr "lan-vip-group"
set service "all"
set schedule "always"
set logtraffic enable
set status enable
set action accept
set nat disable
end

FortiGate

ozkanaltas

Valued Contributor III

Hello @Anonymous_User ,

I don't have any experience with Cisco ASA, but FortiGate doesn't support configuration like yours.

Because you want to translate the same public IP to a different private IPs. If you want to use them like that, you should configure port mapping also.

Your second question: Yes, you can use your public IP addresses for both sides (DNAT and SNAT). But for snat, you should configure ip pool.

funkylicious

SuperUser

if i recall correctly, nat (inside,outside) static 89.1.1.1 , is for SNAT - all traffic from 172.16.1.0/24 towards the Internet to be NAT-ed with the public IP of 89.1.1.1 - you can achieve that with IP Pool or just using the exit interface if it's configured wth that IP.

"jack of all trades, master of none"

Sign up

Login with SSO

Login to the community

Login with SSO