A tricky NAT statement in ASA to be converted in Fortinet

[Jamshaid]

Hey 

So I am currently handling a migration from ASA to Fortinet for which I had encountered many challenging NAT statements but this one is the most confusing with not much solution available as per my research so far. Any help would be appreciated 

So there is this NAT statement in ASA 

nat (dmz,inside) source static obj-1.1.1.1 obj-1.1.1.1  destination static obj-2.2.2.2 obj-3.3.3.3

Similarly 

nat (inside,outside) source dynamic obj-5.5.5.5 obj-6.6.6.6 destination static host-4.4.4.4 host-4.4.4.4

How would I be able to achieve this in Fortigate ( I am using central enabled in our deployment )

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[Debbie_FTNT]

Hey Jamshaid,

from what I have been able to find, you would have to break down those statements:

- FortiGate would have a Central NAT (or a Central SNAT and DNAT) table, with separate rules for SNAT and DNAT

-> the NAT statements above would need to be separated into the source and destination parts

-> "source static obj-1.1.1.1 obj-1.1.1.1" for example would translate to a Source NAT entry with real IP 1.1.1.1 and mapped IP 1.1.1.1 (or whatever is appropriate)
-> "destination static obj-2.2.2.2 obj-3.3.3.3" would translate to a Destination NAT entry with real IP 2.2.2.2 and mapped IP 3.3.3.3 (or whatever IPs are appropriate)
-> the interfaces and linking the SNAT and DNAT rules would happen via a firewall policy