How Involved DNAT & VIP configuration when Central NAT is enabled // FortiGate

[LaD]

Hi, 

we have firewall with central NAT enabled. Some communications are  initiated from inside network and going towards outside network. 

Original Source IP - 172.19.60.100

Original Destination IP - 192.168.23.5

Source NAT IP - 192.168.48.12

as per the central NAT rules defined this traffic is getting source NATed to the 192.168.48.12 when going through the firewall.

Also, we have configured some DNAT & VIP like below for traffics which are originated from external side.

External IP - 192.168.48.12

Mapped IP - 172.19.60.120

When considering this 192.168.48.12 is the source NAT ip for the traffics initiated from 172.19.60.100. Also this is external IP for the traffics initiated from external and its map to the inside ip 172.19.60.120 which is different than 172.19.60.100.

will this works as expected or will there be any issues ?

Thanks

[ebilcari]

I don't think it will cause any issue since SNAT and DNAT tables are different (directions). Even that you are using a private IP, this is a common scenario for small networks that use a single public IP to SNAT the user traffic and DNAT some of the servers using the same public IP. In this case the IP 192.168.48.12 will have the 'role' of the public IP.

[akumar02]

Hello @LaD,

Starting from 6.2 there is a new feature 'match-vip-only' to apply to a policy when Central NAT is enabled.

The VIP/DNAT with central NAT is explained in this article:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-firewall-policies-for-a-VIP-when...