| Description | This article describes how to configure port forwarding in policy-based mode. |
| Scope | FortiGate. |
| Solution |
In policy-based mode, it is not necessary to put the VIP in the 'destination' field of a firewall policy. As long as the VIP is in place, FortiGate will perform port forwarding accordingly. In this example, it is configured to forward port 22 to 10.0.0.1.
To create a VIP object, go to Policy & Objects -> DNAT & Virtual IPs and select 'Create New'.
It is also necessary to make sure that there is an allowed policy under SSL Inspection & Authentication. Otherwise, the traffic will hit the implicit deny rule. In the example below, the ‘Default’ policy is allowing any to any.
Below is the debug flow output showing that the traffic is being NATed from 10.9.31.3 to 10.0.0.1 correctly. Policy-1 represents the ‘Default’ policy.
|
