Fortigate packet processing DNAT vs existing connection return path, what will it do?

[DrDing_Muscle]

Hey everybody.  I have a question about how a Fortigate 1000D will process a packet in regard to DNAT vs an already existing connection that was initiated in its connection table.  I have 2 servers inside my system that are webservers and are IPed with IPs from the 10.0.0.0/8 private IP space.  One of them initiates an SFTP connection out to an external entity/network.  On the way out of the Fortigate I have a SNAT pool set to overload to SNAT these packets to a public network X.X.162.10.   On this same Fortigate I also have a DNAT for external IP X.X.162.10 for traffic initiating on the outside to come in but the DNAT is pointed to a Virtual Server IP of an f5 Big IP LTM load balancing device.  When the traffic from my connection that initiated inside my system comes back from the other side or distant end what is my fortigate going to do with it?  Will it realize it is the return path for an existing connection that initiated outbound or will it process it as a DNAT since I have a DNAT for that same IP?  This is causing me issues because I believe at times my return path traffic is being sent to the f5 load balancer and sometimes the return traffic makes it back to the wrong server.   Thanks in advance. 

[Nicholas_Doropoulos]

The easiest way to find out would be to run a debug flow with the traffic flowing in real time. It should be something along these lines:

diag debug enable diag debug flow filter add <PC1>    or    diag debug flow filter add <PC2> diag debug flow show console enable diag debug flow trace start 100          <== this will display 100 packets for this flow diag debug enable

Feel free to modify the filters accordingly for your case.

[emnoc]

Those are two sessions; the fortigate maintain state; maintain  direction, along with the above suggestion you can reveiw the diag sys session

The device is not going to  get confuse if that's what your thinking is  leading to ;)