Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
johnlloyd_13
Contributor

Convert Cisco ASA Source/Destination Static NAT

hi,

i have a cisco ASA that will convert to FG.

i saw a "NAT trick" configured wherein both the source and destination have a static NAT.

i only know about FG source NAT (SNAT) and destination NAT (DNAT).

how do i configure this in FG? is there a CLI equivalent for this kind of "NAT trick"?

 

nat (inside,outside) source static 10.14.8.5 185.1.2.5 destination static 10.15.0.1 89.25.8.12

 

Thanks,
John
Thanks,John
7 REPLIES 7
AEK
Honored Contributor II

Hi John

Can I ask where such NAT is used or for what can it be useful?

AEK
AEK
johnlloyd_13

hi,

this link will explain the destination NAT config use case in cisco ASA:

https://subrun.blogspot.com/2017/08/destination-nat-in-cisco-asa.html

 

i'll need to migrate this config into FG.

do you know how to configure this in a FG and achieve the same end result?

Thanks,
John
Thanks,John
AEK
Honored Contributor II

Hi John

Sorry I thought it was some kind of source NAT and destination NAT at the same time :)

Actually your document is about destination NAT and here are the different ways to do it on FortiGate:

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/728694/policy-with-destination-nat

AEK
AEK
johnlloyd_13

hi,

i read the link you gave but it didn't cover the source and destination NAT or two-way NAT type:

nat (inside,outside) source static 10.14.8.5 185.1.2.5 destination static 10.15.0.1 89.25.8.12

 

is there other fortinet document/link or if someone can give the "converted" command in CLI for the above?

Thanks,
John
Thanks,John
Peterwilliam123
New Contributor

Hello!
I hope you will change using these code:

 

vbnet code
config firewall address
edit "source_nat"
set subnet 10.14.8.5 255.255.255.255
next
edit "destination_nat"
set subnet 10.15.0.1 255.255.255.255
next
end

config firewall policy
edit 0
set srcaddr "source_nat"
set dstaddr "destination_nat"
set action accept
next
end


This configuration creates two address objects, one for the source NAT and one for the destination NAT. Then, it sets up a firewall policy allowing traffic from the source NAT address to the destination NAT address. Adjust the names and IP addresses as needed for your network setup.
If it does not change go to the youtube.com see and see in the videos, i hope you will find the best trick.

Nchandan
Staff
Staff

Hi John!

 

The configuration you provided from Cisco ASA involves both source NAT and destination NAT, which can be achieved using VIPs and SNAT policies in FortiOS.

Here's how you can configure the equivalent of the provided Cisco ASA NAT trick in FortiOS:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati...

 

Hope it helps.

 

AEK
Honored Contributor II

Hi @Nchandan 

How does it involve SNAT? I see only DNAT here.

AEK
AEK
Labels
Top Kudoed Authors