Destination NAT

[molivsk]

I am in the process of transitioning from a Cisco ASA to a Fortigate FW.  A new requirement is to use destination NAT in an effort to cut down on address space usage.  I am unsure of the destination NAT process on the Fortigate, so hoping this forum may help.  The design is to have a private network between our router and Fortigate FW (outside interface) and another private network on the inside interface.  I would like to NAT a public address space on the Fortigate to the inside private network.  Do I need an interface on the Fortigate with that public address space or can the Fortigate perform destination NAT for the public address space to the inside private space without having an interface on the public network.  Hope this makes sense

- Matt

[ede_pfau]

Yes, that is possible.

Viewing from the FGT, it is not important if a public WAN address is forwarded to an internal private address, using DNAT, or a private WAN address is forwarded. The process is the same. Only the routing is different (easier).

Let'z assume:

public/ISP router

1.1.1.1/28         i.e. public usable addresses .3 to .14

|

|

1.1.1.2

your WAN router

10.10.10.1/28    (at least as big as the public subnet)

|

|

10.10.10.2

your FGT

192.168.10.1/24

|

|

192.168.10.99

LAN server

goal: map 1.1.1.3 to internal 192.168.10.99

steps:

1- your WAN router DNATs 1.1.1.3 to 10.10.10.3

2- your FGT DNATs 10.10.10.3 to 192.168.10.99

for this, create a VIP (virtual IP) with external address=10.10.10.3, mapped-to address=192.168.10.99

and

a policy from WAN to LAN, source addr=all, dest addr=VIP

routing:

on LAN server: default route=192.168.10.1 (your FGT)

on your FGT: default route=10.10.10.1 (your WAN router)

on your WAN router: default route=1.1.1.1 (your ISP router)

On the way in, traffic is NATted twice - only the destination address is exchanged, the source address is kept.

On the way out, traffic is NATted twice again: but this time source NAT!

On the FGT, the VIP will do this automatically if you do not port forward. (actually, it doesn't matter if you apply SNAT here, as your router is not a security device and will not drop traffic from unknown source networks (I hope)).

On your router, you will need to create a source NAT (as always; the public egress interface IP will do). The destination address will be kept.

You see, it's that simple. Only your router inbetween will take special treatment. But as you know Cisco equipment, this should be easy...