Weird behavior central SNAT / DNAT VIP
Since I come frome cisco, the way I have to configure NAT in Fortigate is new to me. I have a working configuration but some settings don't make sense to me...
public ip range: 1.2.3.32/27
Fortigate public ip: 1.2.3.36
dmz interface: 10.9.11.1/24
webserver: 10.9.11.254
My goal is a bidirectional nat for a webserver using the public ip 1.2.3.43.
I found the following KB: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-VIP-s-External-IP-Address-for-Source/ta-p/209514
1. It doesn't matter which interface I use in vip config (extintf) the traffic works anyway no matter if it makes sense or not. Why is that and how should I do it the right way?
2. Configuring "set srcintf-filter dmz" as mentioned in the linked KB results in it not working anymore...
Even more confusing is the fact that this worked a few days ago and yes I did clear the nat cache multiple times in between (diagnose sys session clear).
For my understanding coming from cisco a destination nat should contain source interface (incoming traffic), source network, destination interface and destination network.
For testing purposes I deleted all other nat rules except the default SNAT for outgoing traffic. Currently the configuration looks like this. Incoming and outgoing traffic via the public ip 1.2.3.43 works with this but I'm afraid that this changes somehow when I go live with the firewalls as it already did earlier.
fortigate # sh firewall vip webserver
config firewall vip
edit "webserver"
set extip 1.2.3.43
set mappedip "10.9.11.254"
set extintf "port1"
set nat-source-vip enable
next
end
fortigate # sh firewall ippool SNAT_1.2.3.43
config firewall ippool
edit "SNAT_1.2.3.43"
set type one-to-one
set startip 1.2.3.43
set endip 1.2.3.43
next
end
fortigate # sh firewall central-snat-map
config firewall central-snat-map
edit 1
set srcintf "dmz_zone"
set dstintf "port1"
set orig-addr "SH_webserver-10.9.11.254"
set dst-addr "all"
set nat-ippool "SNAT_1.2.3.43"
next
