FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 242082
Description This article describes the scenario for VIP port forwarding in an NGFW policy-based central NAT setup.
Scope FortiGate Central NAT.

In the scenario of 2 DNATs are configured. One DNAT with port forwarding but the other DNAT without.



If the DNAT without port forwarding is on top, then it will not match the port forwarding VIP.


Debug flow: 


id=20085 trace_id=31 func=ipv4_fast_cb line=53 msg="enter fast path"
id=20085 trace_id=31 func=ip_session_run_all_tuple line=7140 msg="DNAT x.x.3.26:33389->y.y.3.23:33389"


The firewall will not do the port mapping from 33389 to 3389.


It is necessary to move the VIP object with port forwarding to the top from GUI. 


Or from CLI:


# config firewall vip

move test2 before test1




With the above changes, FortiGate will match test2 prior to test 1.


Debug flow: 


id=20085 trace_id=36 func=ipv4_fast_cb line=53 msg="enter fast path"
id=20085 trace_id=36 func=ip_session_run_all_tuple line=7140 msg="DNAT x.x.3.26:33389->y.y.3.23:3389"


Now the port is forwarding from 33389 to 3389.