Fortinet and pubblic ip

[oenrico]

Good Morning i' m a question and sorry for my english I have a firewall fortigate 80c with software versione 5.0.1 I have 5 pc 192.168.0.1 192.168.0.2 192.168.0.3 192.168.0.4 192.168.0.5 and firewall 192.168.0.250 i have a connection internet with fix ip public ( class of ip public 255.255.255.248) my question is is it possible pc 192.168.0.1 navigate in internet with public internet different and pc 192.168.0.2 navigate in internet with different ip public Thank you very mutchhh

[ede_pfau]

hi, and welcome to the forums. Yes that is possible: to have multiple internal hosts use different public IP addresses when accessing the internet. This is the way to do it: When traffic from an internal host passes the Fortigate it has to get a public source address so that it can be routed on the internet. Your ISP knows where to send the reply traffic back to looking at that public IP address. Exchaning the source address is called source NAT. On a Fortigate you do that in the policy from ' internal' to ' wan1' (or whatever port you use for WAN access). You check the ' Dynamic NAT' checkbox to enable source NAT. Without any other changes the FGT will now use the public IP of that port as the source address of all outgoing traffic. If you want to use a different IP address then define this address as an ' IP pool' . It' s located in ' Firewall objects' . You can define an IP pool with just one address if you like. When checking the ' Dynamic NAT' option in the policy you can also specify this IP pool to be used. Usually an IP pool contains several addresses. Say, you have 8 public addresses in a pool. Then these addresses will be used one after the other until exhausted, and then the FGT starts at the first address over again. This way is efficient but you cannot tell which internal host will use which public address. That' s where one-address-IP pools come in. Use one IP pool with one public address in one policy matching only one internal source address. For 5 internal hosts you will need 5 policies but you will know for sure which host is using which public address. Hope this will do for you.

[ShrewLWD]

Also, please upgrade your firmware to at least 5.0.7. There are significant issues with versions 1,2 and 3. 4 is stable, but is prone to the heartbleed vulnerability, as is 5 and 6. They are up to 5.0.9 now, so you may want to move through the recommended firmware upgrades all the way up to 5.0.9 EDITED to concur with Istvan below, in case someone stops reading here!

[Istvan_Takacs_FTNT]

From the 5.0.9 Release Notes; " FortiOS v5.0 Patch Release 9 officially supports upgrading from FortiOS v5.0 Patch Release 6 or later." FortiOS 5.0.9 Release Notes http://docs.fortinet.com/d/fortigate-fortios-5.0.9-release-notes

[MikePruett]

You can apply certain natting to your policies to make certain internal addresses show as certain outside addresses (as long as you have those addresses overloaded to the wan interface.

[RafalS]

is it possible pc 192.168.0.1 navigate in internet with public internet different and pc 192.168.0.2 navigate in internet with different ip public

Hi, ede_pfau proposed one solution based on single-address pools and multiple policies. There' s another, based on Central NAT Table (which I believe is more object-oriented and hence more configuration efficient). Start by reading this: http://docs-legacy.fortinet.com/cb/html/index.html#page/FOS_Cookbook/Firewall/cb-firewall-snat3.html As you' ve seen, Central NAT Table lets you define NAT rules not only per IP address but also per port numbers. If you want to ignore the port numbers, just follow the pattern: Nat ID 1 Source Address = IP_Inside_1 Translated Address = IP_Ouside_1 Original Source Port = 1-65535 Translated Port = 1-65535 Nat ID 2 Source Address = IP_Inside_2 Translated Address = IP_Ouside_2 Original Source Port = 1-65535 Translated Port = 1-65535 etc. where obviously IP_Inside_1 = 192.168.0.1 IP_Inside_2 = 192.168.0.2 etc. While configuring a firewall policy, be sure to tick " Enable NAT" and choose " Use Central NAT Table" Good luck! Rafal

[oenrico]

Thank you very mutch for the support