Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ping
New Contributor

Destination NAT

Hi,

I am new to the Foritgate systems. We just purchased a 92D that replaced a old Check Point firewall. I want to translate the policy and nat configuration from Check Point to Fortigate.  What is the best way to write this Nat rules on Fortigate?   <---------------Original Packet---------------><-----------Translated Packet------------>   <---Source---><---Dest---><----Service---><---Source---><---Dest---><----Service---> 1-        any            2.2.2.2            80                   Original          3.3.3.3        8080 2-        any            2.2.2.2            any                  Original          3.3.3.3        any     I have done some test with VIP configurations but I don't found the way to insert the second configuration line. When I insert the second VIP I receive this error: "A duplicate entry already exists."

Can you give me some tips/advice on how to configure this NAT?

Thanks.

6 REPLIES 6
tclark
New Contributor

You will need to specify non-overlapping ports if you want to forward 80 to 8080.

 

config firewall vip
edit "Test1"
set extip 2.2.2.2
set extintf "wan1"
set portforward enable
set mappedip "3.3.3.3"
set extport 80
set mappedport 8080
next
edit "Test2"
set extip 2.2.2.2
set extintf "wan1"
set portforward enable
set mappedip "3.3.3.3"
set extport 1-79
set mappedport 1-79
next
edit "Test3"
set extip 2.2.2.2
set extintf "wan1"
set portforward enable
set mappedip "3.3.3.3"
set extport 81-65535
set mappedport 81-65535
next
end

 

Make sense?

ping
New Contributor

Yes, I used this workaround . But you must consider that in my example I used "service=any" that it means all protocols (tcp , udp and icmp). In your declaration you use only tcp protocol. If you want to consider all protocols I think that you must define a VIP Group that contains these definitions : <---Source---><---Dest---><----Service------> <---Source---><---Dest---><----Service---> 1- any               2.2.2.2          tcp:80                Original           3.3.3.3         tcp:8080 2- any               2.2.2.2          tcp:1-79             Original           3.3.3.3         tcp:1-79 3- any               2.2.2.2          tcp:80-65535      Original           3.3.3.3         tcp:80-65535 4- any               2.2.2.2          udp:any              Original           3.3.3.3         udp:any 5- any               2.2.2.2          icmp                   Original           3.3.3.3         icmp

Than you can use this VIP Group on the policy (in the destination address section).

For now, I have found only this solution.

ede_pfau

set protocol icmp
is new in v5.2 and (finally) allows testing NATted servers with ping. As ICMP is a portless protocol it couldn't get across port-forwarding VIPs in the past.

 

@ping: the way to go. Except for creating the 5 VIPs, not so much hassle. One could argue if the implicit port-overlap which is allowed with Checkpoint isn't a potential security risk...

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
ping
New Contributor

Thank you for the quick reply. Infact, for the fifth rule I created this VIP with "set protocol icmp":

edit "VIP_ICMP"         set extip 2.2.2.2         set extintf "any"         set portforward enable         set mappedip "3.3.3.3"         set protocol icmp next I don't think that implicit port-overlap is a potential security risk because there is always a policy that block or permit the traffic on a different port and protocol.

ede_pfau

I know it's working but isn't

   set portforward enable and    set protocol icmp

a contradiction in itself? ICMP is portless.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
ping
New Contributor

May be, but if you don't "set portforward enable" you can't use "set portforward enable".

 

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors