Technical Tip: Outbound Traffic uses VIP IP as SNAT IP

[hhasny]

Description	This article describes the behavior of SNAT when VIP is configured (no port forwarding).
Scope	FortiGate.
Solution	FortiGate has two options to perform SNAT, configurable in the firewall policy. Use Outgoing Interface Address. Use Dynamic IP Pool. When VIP is configured as one-to-one mapping (no port-forwarding) with 'any' external interface, FortiGate will use this VIP IP address as its SNAT IP address.   Below is a firewall policy configuration example with 'Use Outgoing Interface Address' as its SNAT IP: Below is the SNAT IP used for outbound traffic from 10.201.1.181: Below is the Virtual IP configuration: When the above VIP is used or referenced in a firewall policy, outbound traffic from host 10.201.1.181 will use 10.47.17.177 (VIP IP) as its SNAT IP: Note: If it is desired to have the specific host/server IP used as a mapped IP to access the internet via another public IP, the only way is to use IPPOOL on the firewall policy, allowing the host to access the internet. That way it will not use VIP IP as SNAT IP but use the IPPOOL IP/range.  Though the outgoing interface IP is 10.47.17.176, it still requires a dynamic ippool and is selected in the outbound firewall policy. config firewall ippool     edit "SNAT_VIP"         set startip 10.47.17.176         set endip 10.47.17.176     next end config firewall policy     edit 1         set name "OutBound"         set srcintf "port10"         set dstintf "port1"         set action accept         set srcaddr "all"         set dstaddr "all"         set schedule "always"         set service "ALL"         set ssl-ssh-profile "certificate-inspection"         set logtraffic all         set nat enable     next end Note: This scenario is valid when Central NAT is disabled on the FortiGate.