Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Umesh
Contributor

Fortigate Dynamic SNAT || Fixed port range concept ||

Dear community member,

 

I want to clear my doubt from you all regarding Fixed port range what I understand from docs.fortinet.com.

Request you to please go through below written points and check whether it is correct or not.

 

Fixted port range -

1. In overload and one-to-one IP pool types, we do not need to define the internal IP range.
2. In fixed port range type of IP pool we can define both internal IP range and external IP range. we can calculate the port range for each address translation combination. So we call this type fixed port range.
As we know that If we define single external IP/Public IP in the IP pool So this single public IP can handle the conversation of 60416 private ip address with 60416 port number as well.

For example if we use external IP (172.16.200.1-172.16.200.1) in the IP pool and map (10.1.100.1-10.1.100.10) so how many Port numbers can get per IP as follows

External IP - 172.16.200.1 (available port 60416)
Internal IP/Private which is 10 as of now - 60416/10 = 6041 (around) port per IP

Source IP Source Port no Translated IP translated Port no
10.1.100.1 xxxx 172.16.200.1 4512 <---------------------(Rangefrom 1 to 6041)

4. This type of IP pool is a type of port address translation (PAT).

5. Basically we can restrict users by protecting port range If port range exceeded  then user gets disconnected.

let suppose defined port range 60 and user is exceeded  61 then gets disconnected.

 

Fixed port range.JPG

 

I had gone through  - https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/29961/dynamic-snat

 

Thank you for reading my pointes .

 

I hope you will be able to clear my queries.

 

Thank you advanced.

Fortigate Learner

 

 

1 REPLY 1
anignan
Staff
Staff

Hi @Umesh ,

 

Regarding this 10.1.100.1 xxxx 172.16.200.1 4512 <---------------------(Rangefrom 1 to 6041)

There are reserved ports so according to the documentation it should start with 5117 so the range will be 10.1.100.1 xxxx 172.16.200.1  <---------------------(Rangefrom 5117 to 11158)

11158 is 5117+6041

 

Abdel

Top Kudoed Authors