Fixed NAT pool

[laf]

Hi guys,

I setup a firewall rules with a fixed range of IP addresses as source traffic toward a large group of IPs as destination and NAT (sNAT) using a fixed range of IP addresses too.

The two ranges of IPs are equal:

Here's the FW rule:

edit 53 set srcintf "LANs" set dstintf "VPNinterface" set srcaddr "LAN_pool" set dstaddr "VPN_ENC" set action accept set schedule "always" set service "ALL" set nat enable set fixedport enable set ippool enable set poolname "VPN_pool" next

Here are the objects definition:

config firewall address edit "LAN_pool" set type iprange set associated-interface "LANs" set start-ip 172.25.3.196 set end-ip 172.25.3.209 next end

config firewall ippool edit "VPN_pool" set type one-to-one set startip 192.168.3.196 set endip 192.168.3.209 next end

How can I make sure 172.25.3.199 always uses 192.168.3.199 and so on: .200 to .200...

Thanks in advance!

P.S. I found this on KB, still I find it a bit weird. Anyone used it?

[rwpatterson]

I used it in the past, a very long time ago. It worked as designed. If it would help you sleep better at night, make IP reservations ensuring that the right IPs are associated with the right MACs and only those units will get out with their IP addresses.

[laf]

Thanks Bob, always at duty here!

Now I downloaded Fortigate-CLI 5.2 and found this at page 124:

type {one-to-one | overload | fixed-port-range | port-block-allocation}

Select the type of IP pool:

one-to-one — one-to-one mapping

overload — clients can share pool IP addresses

fixed-port-range — fixed mapping of source-startip / source-endip range to startip / endip range.

Now what do you think of this configuration:

config firewall ippool edit "VPN_pool" set type fixed-port-range set startip 192.168.3.196 set endip 192.168.3.209 set source-startip 172.25.3.196 set source-endip 172.25.3.209 next end

Will it work?

It's 7 pm here and although I placed a sniffer can't see any traffic as people left the office. 

[ede_pfau]

VIPs are primarily used for Destination NAT but have the side effect of NATting traffic initiated by the destination (e.g. from an internal server with a private address back to an external client). This topic came up so often that the feature was finally incorporated in FortiOS v4.

Even if it sounds a bit weird the sniffer traces prove that it works. Try it out and see for yourself.

[laf]

ede_pfau wrote:

VIPs are primarily used for Destination NAT but have the side effect of NATting traffic initiated by the destination (e.g. from an internal server with a private address back to an external client). This topic came up so often that the feature was finally incorporated in FortiOS v4.

Even if it sounds a bit weird the sniffer traces prove that it works. Try it out and see for yourself.

So you're too suggesting trying that old v4. article for my scenario or the latest fixed-port range cli addition I just configured?

[ede_pfau]

I'd go with the KB article as you want an exact mapping.

The regular "1-to-1" NAT will work as well but you have no control over the substituted address - first come, first served.

edit: this v4 recipe will work in v5 as well. Basic features don't change that fast.

[laf]

Went straight to Fortiview All Sessions and filtered after Policy ID. I can see straight Source and NAT Source working as expected.

So fixed-port-range type ip pool works for binding local IP to a NAT IP as long as IP ranges are equal.

Thanks again guys for the support!