Technical Tip: VIP/DNAT port forwarding not working (NGFW Policy based central NAT)

btey · ‎01-05-2023

Description

This article describes the scenario for VIP port forwarding in an NGFW policy-based central NAT setup.

Scope

FortiGate Central NAT.

Solution

In the scenario of 2 DNATs are configured. One DNAT with port forwarding but the other DNAT without.

If the DNAT without port forwarding is on top, then it will not match the port forwarding VIP.

Debug flow:

id=20085 trace_id=31 func=ipv4_fast_cb line=53 msg="enter fast path"
id=20085 trace_id=31 func=ip_session_run_all_tuple line=7140 msg="DNAT x.x.3.26:33389->y.y.3.23:33389"

The firewall will not do the port mapping from 33389 to 3389.

It is necessary to move the VIP object with port forwarding to the top from GUI.

Or from CLI:

# config firewall vip

move test2 before test1

end

With the above changes, FortiGate will match test2 prior to test 1.

Debug flow:

id=20085 trace_id=36 func=ipv4_fast_cb line=53 msg="enter fast path"
id=20085 trace_id=36 func=ip_session_run_all_tuple line=7140 msg="DNAT x.x.3.26:33389->y.y.3.23:3389"

Now the port is forwarding from 33389 to 3389.