Can translate source port "Any" to a specific port on fortinet central SNAT?

[WQ]

Hi , can someone pls advise whether can translate source port "Any" to a specific tcp port on fortinet central SNAT? thanks in advance ! 

[kaman · Accepted solution]

Hi WQ,

To configure a specific source port range to be used from the FortiGate a Central SNAT policy must be used. The option to translate source ports is only available when a dynamic IP pool is used.

Reference Link: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-source-port-translation-u...

On FortiOS 7.4.x is introduced a new feature which will allow adding a destination-port as a criterion to config a firewall Central-NAT rule.

To configure a dst-port it is only possible to use CLI, the destination port is not visible on the GUI.

Reference Link: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-the-destination-port-for-the-Cen...

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards,
Aman

[Carson_Daniels]

FortiGate Central SNAT cannot translate “Any” source port to one fixed TCP port. It only uses dynamic port allocation (PAT).
To control ports, you’d need policy-based NAT, and even then fixed source ports are very limited and not recommended.

[WQ]

hi @Carson_Daniels @kaman , there is one field "Explicit Port Mapping" under central SNAT, can translate the source port range to a specific port, please verify. Thanks.

[hooram95]

FortiGate Central SNAT doesn’t really support translating a source port defined as “Any” into one fixed, specific TCP port, since source ports are normally dynamically assigned to avoid conflicts. You can control destination ports pretty well, but forcing all traffic to use a single source port would likely cause session issues and isn’t how SNAT is designed to work. If you have a specific use case, it might be better handled with a different policy approach or by adjusting the application or service instead of the SNAT itself.