VIP (DNAT) effect on SNAT behavior

Question

Hi,

FortiOS 7.0.x. We have defined a VIP translating address external X.X.X.X -> internal Y.Y.Y.Y, like this:

config firewall vip
edit "vip_server_vpn"
set type static-nat
set extip X.X.X.X
set mappedip "Y.Y.Y.Y"
set extintf "any"
set portforward enable
set extport 1-65535
set mappedport 1-65535
next
end

We are using this VIP in multiple firewall policies with traffic coming in on different IPSEC tunnel interfaces.

It works as expected. Now we want to initiate outgoing connections from the internal server Y.Y.Y.Y -> Internet (0.0.0.0/0), in the related firewall policy we have enabled "NAT / Use outgoing interface address".

As we can see from traffic capture, the SNAT is performed using the external VIP address (X.X:X.X) and not the external interface IP. This behavior is unexpected. We would like to SNAT to the FGT external interface IP address.

I had a look here in the knowledge base and in the article https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-VIP-s-External-IP-Address-for-Source/ta-p/189947 it is stated:

"->When port-forwarding is disabled on the VIP and Source NAT with Outgoing Interface Address is enabled on Firewall Policy#1, Irrespective of the 'nat-source-vip' setting, traffic matching firewall policy #1 will be Source NAT'd with VIP's external IP address instead of the outgoing physical interface IP address."

OK, that is clear, but in our case we have the port-forwarding enabled. For this it is stated:

"-> When port-forwarding is enabled on the VIP, The 'nat-source-vip' setting must be enabled and VIP's external IP will be used for SNAT only when the source port of the HOST generated traffic falls in the port range configured for VIP."

My conclusion was, when port-forwarding is enabled on the VIP, and nat-source-vip is disabled, the SNAT would use the FGT interface IP and not the VIP external IP.

Is the exact behavior (for all possible cases) documented somehwere? Like in a table?

What would be the solution in our case? Would we end up in defining a specific VIP (even if the external vip ip is the same) for each specific IPSEC tunnel interface using a different "extintf <tunnel>" for each?

Sachin_Alex_Cherian_ · Accepted Answer

Hi Walter,

Setting 'nat-source-vip' controls how the snat applies and is done in the following order:

1. reverse SNAT according to the VIP if nat-source-vip enabled; otherwise
2. ippool specified in the policy (lan to wan policy)
3. reverse SNAT according to the VIP if nat-source-vip is disable
4. ip of the outgoing interface

Keeping the above in mind, with port forwarding enabled if the server-initiated traffic matches the configured ports in the vip, only then the vip external IP would be used. If it does not match the vip ports configured in port-forwarding the interface IP would be used.
In your case, since the port forwarding is done for 1-65535, logic as per rule 3 mentioned above gets applied.

Having explained the above, I guess you have 2 options:
1) restrict the port forwarding to specific service ports, as Graham suggested earlier.
2) If the ports have to be wide open or the server initiates back traffic on the same port, you can use an ippool to override the vip while doing snat.

Hope the above explanation helps with your setup.

gfleming · Answer

The problem is you have defined the entire range of ports in your VIP so any outgoing traffic from the server will use one of those ports and so the VIP extip will be used in SNAT.

Can you narrow down the ports used in the VIP?

Sign up

Login with SSO

Login to the community

Login with SSO