1 to 1 nat vip

[ctrl_alt_del3t3]

Hello guys i have a fortigate 100d. I think it is a simple deal but i wanted to confirm either way. I have a phone system that is receiving sip traffic for telco. This telco system was connected directly to the net with a public address. I wanted to bring the phone system behind the firewall and nat all traffic to it. Please let me know if this is the right way to do it

FG100d

7.7.7.7 255.255.255.252 

telco

7.7.7.8 255.255.255.252 

First i would setup a vip like so External IP Address/Range 7.7.7.8-7.7.7.8 with a mapped internal address to 192.168.1.5-192.168.1.5

config firewall vip edit "Cisco-SIP" set extip 7.7.7.8 set extintf "wan1" set mappedip "192.168.1.5-192.168.1.5" next

edit 4 set srcintf "wan1" set dstintf "lan" set srcaddr "all" set dstaddr "Cisco-SIP" set action accept set schedule "always" set service "Cisco-Phones" next

FGT100D # show firewall service custom config firewall service custom

edit "Cisco-Phones" set category "VoIP, Messaging & Other Applications" set tcp-portrange 5090:0-65535 5000:0-65535 set udp-portrange 9000-9049:0-65535 5060:0-65535 5090:0-65535 next

[rwpatterson]

Looks good from here. You'll need one additional policy for outgoing traffic from the phone switch. Not sure how well the SIP helper has matured, but you may need to muck with that as well. (muck as in delete...)

[ctrl_alt_del3t3]

good call on the sip helper i am going to disable it right now. 

Also shouldn't the normal  outbound policy take care of it?

set srcintf "lan" set dstintf "wan1" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ALL" set utm-status enable set av-profile "AV" set ips-sensor "IPS" set profile-protocol-options "default" set ssl-ssh-profile "certificate-inspection" set nat enable

[rwpatterson]

I'm not going assume your outbound policy is wide open (all to all). Just covering all bases. My outbound is heavily filtered. SIP would probably break with IPS and web filtering and such...

[ctrl_alt_del3t3]

Cool thank you for your help. All great ideas!

[hklb]

Your VIP will NAT the inbound traffic, but the outbound traffic will always use the WAN interface IP.

If you want to use the IP 7.7.7.8 for your PBX, you will need add the "nat-source-vip enable" on your NAT :

config firewall vip edit "Cisco-SIP" set extip 7.7.7.8 set extintf "wan1" set mappedip "192.168.1.5-192.168.1.5"

set nat-source-vip enable next

Lucas

[ctrl_alt_del3t3]

Lucas that is another great thought, Thank You. 

When making this change i don't see it reflect in the GUI. 

is this something that normally does not show up?

[rwpatterson]

There are several CLI only options.  This appears to be one of them.

[ede_pfau]

This is not quite correct I'm afraid.

The option "nat-source-vip" prevents the reverse NAT (source NAT) of outgoing traffic from hosts which are not specified explictely in the VIP definition.

This implies (and is indeed the case) that a VIP definition alone will not only translate the destination address on incoming traffic but will also translate the source address in the reply traffic to the external IP address specified in the VIP. In former versions of FortiOS this had to be done manually by defining an IP pool for source NATting. At least from v4.3 on the VIP will take care of this.

As an example: in the DMZ (with 10.11.12.0/24) you've got a server 10.11.12.1. You want to make this server reachable via the public address 1.2.3.4. You create a VIP "ext2server" like this:

name "ext2server"

external address: 1.2.3.4

mapped to: 10.11.12.1

port forwarding: disabled

To put the VIP into effect you use it in a policy:

source interface: wan1

source address: any

dest interface: dmz

dest address: ext2server

service: ALL

action: accept

Now external traffic can reach the server located in the dmz as the destination address is translated from 1.2.3.4 to 10.11.12.1 . When the server responds, it's source address (which in reality is 10.11.12.1) is translated to 1.2.3.4 so that for the external host the whole NAT is transparent.

Now for the "nat-source-vip" parameter.

Enabling or disabling it will have no effect for the scenario given above, i.e. traffic to and from the intended host. But, if there is another host in the DMZ, it's source address is either the real address (if "nat-source-vip" is disabled) or the 'official' virtual IP address specified in the VIP (if "nat-source-vip" is enabled). Use this if your intention is to cloak or hide the true address space of the DMZ hosts, without creating a lot of VIPs or IP pools, as long as at least one VIP exists.

[ctrl_alt_del3t3]

anyone know if this is needed in v5.2.2 build 0642,141118 (ga)