Cybersecurity Forum

This forum is for all security enthusiasts to discuss Fortinet's latest & evolving technologies and to connect & network with peers in the cybersecurity hemisphere. Share and learn on a broad range of topics like best practices, use cases, integrations and more. For support specific questions/resources, please visit the Support Forum or the Knowledge Base.

rmock_FTNT
Staff
Staff

Creating a VIP on Fortigate using a Dynamic IP address

Manny Fernandez

When you have a dynamic IP address assigned by your carrier, you are normally only assigned one IP address to use.  If you had a Fortigate that is attached to a Cable Modem as an example and the modem and the Fortigate are using RFC 1918 addresses, then your VIP would use the RFC 1918 address that is assigned to your Fortigate as the External IP Address/Range using the port mapping section, however if your Fortigate gets a public IP (non-RFC1918) address from the carrier directly on the Fortigate, how are you going to know what public IP address to assign to the VIP?  Thanks to a friend of mine Brian Modlin, that called me because he was dealing with this problem; here is what you can do.  In this article, I am using Central NAT.

For those not familiar with RFC 1918, it is the block of IPv4 addresses that are reserved for internal use and are NOT publicly routable.  These are your 10.0.0.0/8, 192.168.0.0/16 and 172.16.0.0/12.

Dynamic DNS Configuration

Lets start with the Dynamic DNS configuration on the Fortigate firewall.

2019-11-09_19-55-39.png

Here we have a Fortigate 80E configured with a DHCP as its WAN1 configuration.  To configure the Dynamic DNS configuration:

  1. Go to Network
  2. Then choose DNS
  3. Enabled the FortiGuard DDNS
  4. Choose the interface facing the carrier, in my case WAN1
  5. Click the Use Public IP Address
  6. Assign a Unique Location or a host name you are going to use.
  7. And finally, click Apply

Configuring the VIP

2019-11-09_19-55-05.png

Here we can see the VIP that has already been created.  I will describe the config.  First things first, you need to assign a name.  Choose the interface, again for me, it was WAN1. Next on the External IP address/range section, you will use 0.0.0.0 since we do not know the IP the carrier will assign to us.  Next choose the internal IP address for the device you are trying to NAT to.  Enable Port Forwarding since you are going to be sharing it with the Fortigate's dynamically assigned IP address.

Creating the Policy

Finally, we will add a policy. Again, in my case, I am using Central NAT (take a look at the Central NAT blog post)

2019-11-09_19-57-04.png

As you can see in the above screenshot, this is a Camera Server and we can see that we are matching Incoming Interface to WAN1 and the Outgoing Interface is FW VLAN 240 (lan) .  We are also matching all sources and the Destination is the Firewall Address Object of CAMERA SERVER-INT which equates to the 10.131.20.10 address (see below)

Screen Shot 2019-11-09 at 7.57.20 PM.png

You will need to repeat the VIP creation for every port you need to map to.

Hope this helps.

0 REPLIES 0
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.