- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fixed NAT pool
Hi guys,
I setup a firewall rules with a fixed range of IP addresses as source traffic toward a large group of IPs as destination and NAT (sNAT) using a fixed range of IP addresses too.
The two ranges of IPs are equal:
Here's the FW rule:
edit 53 set srcintf "LANs" set dstintf "VPNinterface" set srcaddr "LAN_pool" set dstaddr "VPN_ENC" set action accept set schedule "always" set service "ALL" set nat enable set fixedport enable set ippool enable set poolname "VPN_pool" next
Here are the objects definition:
config firewall address edit "LAN_pool" set type iprange set associated-interface "LANs" set start-ip 172.25.3.196 set end-ip 172.25.3.209 next end
config firewall ippool edit "VPN_pool" set type one-to-one set startip 192.168.3.196 set endip 192.168.3.209 next end
How can I make sure 172.25.3.199 always uses 192.168.3.199 and so on: .200 to .200...
Thanks in advance!
P.S. I found this on KB, still I find it a bit weird. Anyone used it?
The most expensive and scarce resource for man is time, paradoxically, it' s infinite.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I used it in the past, a very long time ago. It worked as designed. If it would help you sleep better at night, make IP reservations ensuring that the right IPs are associated with the right MACs and only those units will get out with their IP addresses.
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Bob, always at duty here!
Now I downloaded Fortigate-CLI 5.2 and found this at page 124:
type {one-to-one | overload | fixed-port-range | port-block-allocation}
Select the type of IP pool:
one-to-one — one-to-one mapping
overload — clients can share pool IP addresses
fixed-port-range — fixed mapping of source-startip / source-endip range to startip / endip range.
Now what do you think of this configuration:
config firewall ippool edit "VPN_pool" set type fixed-port-range set startip 192.168.3.196 set endip 192.168.3.209 set source-startip 172.25.3.196 set source-endip 172.25.3.209 next end
Will it work?
It's 7 pm here and although I placed a sniffer can't see any traffic as people left the office.
The most expensive and scarce resource for man is time, paradoxically, it' s infinite.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
VIPs are primarily used for Destination NAT but have the side effect of NATting traffic initiated by the destination (e.g. from an internal server with a private address back to an external client). This topic came up so often that the feature was finally incorporated in FortiOS v4.
Even if it sounds a bit weird the sniffer traces prove that it works. Try it out and see for yourself.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ede_pfau wrote:VIPs are primarily used for Destination NAT but have the side effect of NATting traffic initiated by the destination (e.g. from an internal server with a private address back to an external client). This topic came up so often that the feature was finally incorporated in FortiOS v4.
Even if it sounds a bit weird the sniffer traces prove that it works. Try it out and see for yourself.
So you're too suggesting trying that old v4. article for my scenario or the latest fixed-port range cli addition I just configured?
The most expensive and scarce resource for man is time, paradoxically, it' s infinite.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'd go with the KB article as you want an exact mapping.
The regular "1-to-1" NAT will work as well but you have no control over the substituted address - first come, first served.
edit: this v4 recipe will work in v5 as well. Basic features don't change that fast.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Went straight to Fortiview All Sessions and filtered after Policy ID. I can see straight Source and NAT Source working as expected.
So fixed-port-range type ip pool works for binding local IP to a NAT IP as long as IP ranges are equal.
Thanks again guys for the support!
The most expensive and scarce resource for man is time, paradoxically, it' s infinite.