VIP for PLC and a Data collector that are in different VLANs

Hello,

Thank you for reaching out. I assumed your goal is source NAT using the ip 10.156.119.2 as your external address. You will need to create an ippool where that address is external and use it in a policy where the source interface is VLAN2 and destination interface is VLAN1, while source subnet is that where you have 192.168.199.2 and destination subnet is the subnet of 10.156.116.0/22. Bare in mind that if this is just for single device talking to another single device you can limit the source and destination address to a /32 if you want. Here is an example of how it would look like:

CLI:
config firewall ippool
edit "kepserver NAT"
set startip 10.156.119.2
set endip 10.156.119.2
next
end

config firewall policy
edit 2
set name "kepserver_policy"
set uuid 6d8c85ac-cddd-51ef-3f42-3b0bd35aebdd
set srcintf "vlan2"
set dstintf "vlan1"
set action accept
set srcaddr "vlan2 address"
set dstaddr "vlan1 address"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
set port-preserve disable
set ippool enable
set poolname "kepserver NAT"
next
end

Thank you,

saleha

Hi @carlaranzaso ,

Your requirements are vague.

My understanding is as below, but not sure if it is correct and need you to confirm:

1) You have a layer 2 device with address 192.168.199.2 on VLAN2 

2) You need to allow this L2 device to access the subnet 10.156.116.0/22 on VLAN1

3) You want to pretend the L2 device to be 10.156.119.2 while accessing the VLAN1 subnet

If so, this is source NAT and you may just use the IP Pool. Please check this KB:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-SNAT-with-IP-pool/ta-p/195322

Hi @carlaranzaso,
Thank you for the reply. AS noted on this forum by dingjerry_FTNT there are some gaps in information. I see that you used one-to-one type for the ippool which is possible bottle nick. Have you tried switching to "overlead" type. I would recommend if that fails to try troubleshooting the issue following the traffic and making sure if this traffic is stopping at the firewall or not:

- disable auto-asic-offload to allow full details in the debug:

config firewall policy

edit <policy id number>

set auto-asic-offload disable

end

- run debug flow while reproducing the problem:
# diagnose debug flow filter addr 192.168.199.2 10.156.116.x and <--- replace the x with the actual ip address of the destination machine

# diagnose debug flow show function enable

# diagnose debug flow trace start 30

# diagnose debug console time enable

# diagnose debug enable

You can share the output here if you want us to take a look.

Thank you,

saleha

Hello @saleha @dingjerry_FTNT ,

To clarify gaps in information i have shared this is what I want to do.

VLAN 1 - 10.156.116.0/22

VLAN 2 - 192.168.199.0/24

Device in VLAN 1 - 10.156.116.1

Device in VLAN 2 - 192.168.199.2

I want to translate the 192.168.199.2 which is currently in VLAN 2, to 10.156.119.2 in VLAN 1. Is this possible given that 192.168.199.2 is a PLC without gateway configuration on that device?