Destination NAT

[ping]

Hi,

I am new to the Foritgate systems. We just purchased a 92D that replaced a old Check Point firewall. I want to translate the policy and nat configuration from Check Point to Fortigate.  What is the best way to write this Nat rules on Fortigate?   <---------------Original Packet---------------><-----------Translated Packet------------>   <---Source---><---Dest---><----Service---><---Source---><---Dest---><----Service---> 1-        any            2.2.2.2            80                   Original          3.3.3.3        8080 2-        any            2.2.2.2            any                  Original          3.3.3.3        any     I have done some test with VIP configurations but I don't found the way to insert the second configuration line. When I insert the second VIP I receive this error: "A duplicate entry already exists."

Can you give me some tips/advice on how to configure this NAT?

Thanks.

[tclark]

You will need to specify non-overlapping ports if you want to forward 80 to 8080.

config firewall vip
edit "Test1"
set extip 2.2.2.2
set extintf "wan1"
set portforward enable
set mappedip "3.3.3.3"
set extport 80
set mappedport 8080
next
edit "Test2"
set extip 2.2.2.2
set extintf "wan1"
set portforward enable
set mappedip "3.3.3.3"
set extport 1-79
set mappedport 1-79
next
edit "Test3"
set extip 2.2.2.2
set extintf "wan1"
set portforward enable
set mappedip "3.3.3.3"
set extport 81-65535
set mappedport 81-65535
next
end

Make sense?

[ping]

Yes, I used this workaround . But you must consider that in my example I used "service=any" that it means all protocols (tcp , udp and icmp). In your declaration you use only tcp protocol. If you want to consider all protocols I think that you must define a VIP Group that contains these definitions : <---Source---><---Dest---><----Service------> <---Source---><---Dest---><----Service---> 1- any               2.2.2.2          tcp:80                Original           3.3.3.3         tcp:8080 2- any               2.2.2.2          tcp:1-79             Original           3.3.3.3         tcp:1-79 3- any               2.2.2.2          tcp:80-65535      Original           3.3.3.3         tcp:80-65535 4- any               2.2.2.2          udp:any              Original           3.3.3.3         udp:any 5- any               2.2.2.2          icmp                   Original           3.3.3.3         icmp

Than you can use this VIP Group on the policy (in the destination address section).

For now, I have found only this solution.

[ede_pfau]

set protocol icmp

is new in v5.2 and (finally) allows testing NATted servers with ping. As ICMP is a portless protocol it couldn't get across port-forwarding VIPs in the past.

@ping: the way to go. Except for creating the 5 VIPs, not so much hassle. One could argue if the implicit port-overlap which is allowed with Checkpoint isn't a potential security risk...

[ping]

Thank you for the quick reply. Infact, for the fifth rule I created this VIP with "set protocol icmp":

edit "VIP_ICMP"         set extip 2.2.2.2         set extintf "any"         set portforward enable         set mappedip "3.3.3.3"         set protocol icmp next I don't think that implicit port-overlap is a potential security risk because there is always a policy that block or permit the traffic on a different port and protocol.

[ede_pfau]

I know it's working but isn't

   set portforward enable and    set protocol icmp

a contradiction in itself? ICMP is portless.

[ping]

May be, but if you don't "set portforward enable" you can't use "set portforward enable".