Technical Tip: How to identify policy ID when CNAT Policy Based is used

[Mohammed_Feroz]

Description	This article describes how to identify different policy IDs when CNAT Policy is used.
Scope	FortiGate.
Solution	When CNAT is enabled with NGFW mode Policy-based traffic processing is handled in three policy types  Security Policy: The policy that handles UTM inspections. Policy ID is mentioned as ngfwid=2 in the below session and policy. Central NAT: The policy that handles Source NAT. SSL Inspection and Authentication: The policy that handles SSL inspection and Authentication. Policy ID is mentioned as policy_id=3 in the below session and policy.   Below is an example of a sample session:  session info: proto=1 proto_state=00 duration=2 expire=57 timeout=0 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=4 origin-shaper= reply-shaper= per_ip_shaper= class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255 state=log may_dirty ndr app_valid statistic(bytes/packets/allow_err): org=60/1/1 reply=60/1/1 tuples=3 tx speed(Bps/kbps): 25/0 rx speed(Bps/kbps): 25/0 orgin->sink: org pre->post, reply pre->post dev=5->4/4->5 gwy=10.5.63.254/0.0.0.0 hook=post dir=org act=snat 172.31.200.109:1->8.8.4.4:8(10.5.50.244:5118) hook=pre dir=reply act=dnat 8.8.4.4:5118->10.5.50.244:0(172.31.200.109:1) hook=post dir=reply act=noop 8.8.4.4:1->172.31.200.109:0(0.0.0.0:0) misc=0 policy_id=3 pol_uuid_idx=16088 auth_info=0 chk_client_info=0 vd=0 serial=0001790f tos=ff/ff app_list=0 app=24466 url_cat=0 rpdb_link_id=00000000 ngfwid=2 npu_state=0x001108 no_ofld_reason: redir-to-ips denied-by-nturbo total session: 1 Related article: Technical Tip: Enabling and Configuring Central SNAT on the FortiGate