Hi,
we have firewall with central NAT enabled. Some communications are initiated from inside network and going towards outside network.
Original Source IP - 172.19.60.100
Original Destination IP - 192.168.23.5
Source NAT IP - 192.168.48.12
as per the central NAT rules defined this traffic is getting source NATed to the 192.168.48.12 when going through the firewall.
Also, we have configured some DNAT & VIP like below for traffics which are originated from external side.
External IP - 192.168.48.12
Mapped IP - 172.19.60.120
When considering this 192.168.48.12 is the source NAT ip for the traffics initiated from 172.19.60.100. Also this is external IP for the traffics initiated from external and its map to the inside ip 172.19.60.120 which is different than 172.19.60.100.
will this works as expected or will there be any issues ?
Thanks
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I don't think it will cause any issue since SNAT and DNAT tables are different (directions). Even that you are using a private IP, this is a common scenario for small networks that use a single public IP to SNAT the user traffic and DNAT some of the servers using the same public IP. In this case the IP 192.168.48.12 will have the 'role' of the public IP.
Hello @LaD,
Starting from 6.2 there is a new feature 'match-vip-only' to apply to a policy when Central NAT is enabled.
The VIP/DNAT with central NAT is explained in this article:
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1502 | |
1011 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.