Technical Tip: Configuration of Internet access with loop back IP

[js2]

Description
This article describes how how to Source NAT for LAN user traffic to internet using loop back interface IP.

Solution
1) Create an IP-pool with loop back interface IP.
2) Refer the IP-pool in the LAN to WAN policy.
3) With this policy use loop back interface IP to do SNAT and forward it to ISP via WAN interface.
4) Ensure the ISP should route the loop back interface IP traffic back from server to FortiGate.

For example:

172.31.131.2 .> FGT WAN -1.40.48.4 >> Gateway- 1.40.48.5.
Loop back IP- 1.1.10.1.

# config system interface
    edit "test"
        set vdom "internal"
        set ip 1.1.10.1 255.255.255.252     <-----
        set type loopback
        set role lan
        set snmp-index 18
    next
end

# config firewall ippool
    edit "1.1.10.1"
        set startip 1.1.10.1
        set endip 1.1.10.1
    next
end

# config firewall policy
    edit 3
        set srcintf "lan"
        set dstintf "wan"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "PING"
        set ippool enable
        set poolname "1.1.10.1"
        set nat enable
    next
end

Traffic from client to internet:

dracarys-kvm13 (internal) # id=20085 trace_id=32 func=print_pkt_detail line=5742 msg="vd-internal:0 received a packet(proto=1, 172.31.131.2:1->8.8.8.8:2048) from lan. type=8, code=0, id=1, seq=19."
id=20085 trace_id=32 func=init_ip_session_common line=5913 msg="allocate a new session-0005fe7e"
id=20085 trace_id=32 func=vf_ip_route_input_common line=2621 msg="find a route: flag=04000000 gw-10.40.48.39 via wan"
id=20085 trace_id=32 func=fw_forward_handler line=799 msg="Allowed by Policy-3: SNAT" <<< Matches the lan to wan policy
id=20085 trace_id=32 func=ids_receive line=298 msg="send to ips"
id=20085 trace_id=32 func=__ip_session_run_tuple line=3486 msg="SNAT 172.31.131.2->1.1.10.1:60417" << SNAT is applied using ippool

Response traffic from server to 1.1.10.1:
id=20085 trace_id=33 func=print_pkt_detail line=5742 msg="vd-internal:0 received a packet(proto=1, 8.8.8.8:60417->1.1.10.1:0) from wan. type=0, code=0, id=60417, seq=19."
id=20085 trace_id=33 func=resolve_ip_tuple_fast line=5823 msg="Find an existing session, id-0005fe7e, reply direction"
id=20085 trace_id=33 func=__ip_session_run_tuple line=3500 msg="DNAT 1.1.10.1:0->172.31.131.2:1"
id=20085 trace_id=33 func=vf_ip_route_input_common line=2621 msg="find a route: flag=00000000 gw-172.31.131.2 via lan"