Hi guys,
I setup a firewall rules with a fixed range of IP addresses as source traffic toward a large group of IPs as destination and NAT (sNAT) using a fixed range of IP addresses too.
The two ranges of IPs are equal:
Here's the FW rule:
edit 53 set srcintf "LANs" set dstintf "VPNinterface" set srcaddr "LAN_pool" set dstaddr "VPN_ENC" set action accept set schedule "always" set service "ALL" set nat enable set fixedport enable set ippool enable set poolname "VPN_pool" next
Here are the objects definition:
config firewall address edit "LAN_pool" set type iprange set associated-interface "LANs" set start-ip 172.25.3.196 set end-ip 172.25.3.209 next end
config firewall ippool edit "VPN_pool" set type one-to-one set startip 192.168.3.196 set endip 192.168.3.209 next end
How can I make sure 172.25.3.199 always uses 192.168.3.199 and so on: .200 to .200...
Thanks in advance!
P.S. I found this on KB, still I find it a bit weird. Anyone used it?
The most expensive and scarce resource for man is time, paradoxically, it' s infinite.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I used it in the past, a very long time ago. It worked as designed. If it would help you sleep better at night, make IP reservations ensuring that the right IPs are associated with the right MACs and only those units will get out with their IP addresses.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
Thanks Bob, always at duty here!
Now I downloaded Fortigate-CLI 5.2 and found this at page 124:
type {one-to-one | overload | fixed-port-range | port-block-allocation}
Select the type of IP pool:
one-to-one — one-to-one mapping
overload — clients can share pool IP addresses
fixed-port-range — fixed mapping of source-startip / source-endip range to startip / endip range.
Now what do you think of this configuration:
config firewall ippool edit "VPN_pool" set type fixed-port-range set startip 192.168.3.196 set endip 192.168.3.209 set source-startip 172.25.3.196 set source-endip 172.25.3.209 next end
Will it work?
It's 7 pm here and although I placed a sniffer can't see any traffic as people left the office.
The most expensive and scarce resource for man is time, paradoxically, it' s infinite.
VIPs are primarily used for Destination NAT but have the side effect of NATting traffic initiated by the destination (e.g. from an internal server with a private address back to an external client). This topic came up so often that the feature was finally incorporated in FortiOS v4.
Even if it sounds a bit weird the sniffer traces prove that it works. Try it out and see for yourself.
ede_pfau wrote:VIPs are primarily used for Destination NAT but have the side effect of NATting traffic initiated by the destination (e.g. from an internal server with a private address back to an external client). This topic came up so often that the feature was finally incorporated in FortiOS v4.
Even if it sounds a bit weird the sniffer traces prove that it works. Try it out and see for yourself.
So you're too suggesting trying that old v4. article for my scenario or the latest fixed-port range cli addition I just configured?
The most expensive and scarce resource for man is time, paradoxically, it' s infinite.
I'd go with the KB article as you want an exact mapping.
The regular "1-to-1" NAT will work as well but you have no control over the substituted address - first come, first served.
edit: this v4 recipe will work in v5 as well. Basic features don't change that fast.
Went straight to Fortiview All Sessions and filtered after Policy ID. I can see straight Source and NAT Source working as expected.
So fixed-port-range type ip pool works for binding local IP to a NAT IP as long as IP ranges are equal.
Thanks again guys for the support!
The most expensive and scarce resource for man is time, paradoxically, it' s infinite.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1692 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.