IP Pool: How to achieve port translation?

[Peddy1976]

Hi all,

I've a doubt. I'm readying on how the IP pool with overload option should works. Documentation says that it should perform port translation but as I see from my logs the source port and the translated source port are always the same. 

The IP pool contains only one IP.

Platform: Fortigate300D

FortiOS: 6.0.12

Many thanks,

Maurizio

[jintrah_FTNT]

Hi,

Is there any benefit changing the source port? Please share the document which you are referring to.

Best regards,

Jin

[Peddy1976]

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/29961/dynamic-snat 

Here is the document I am referring to.

[jintrah_FTNT]

Thanks to share the article, it does not specifically mention that port would be translated always, indeed it mentions about the number of available ports per ip for NAT overload. I agree with Adrian that the source port would be changed when multiple sources uses the same source port to same destination to avoid conflict/clash in outbound sessions considering 5 tuple.  But using any/same source port does not hinder the session otherwise, and generally a dont care value. However, on occasions where source port is to be retained as it is and should be ensured that they are not altered when NAT overloaded, an option provided here is to use 'preserve source port'.

Best regards,

Jin 

[Peddy1976]

Thanks for the explanation. Now it's clear to me how it works.

[akristof]

Hi,

Source port will not always be translated. If there are low amount of sessions, there is high chance that the port will be the same. If you connect from 2 different sources with same ports, then you will see translated port.

[Peddy1976]

Hi Adrian, thanks for the explanation. I didn't find this in the documentation related to NAT overload.

[pminarik]

Perhaps the missing detail you are looking for is that in overload IP-pool scenario (and also in the default SNAT over outgoing interface IP), the FortiGate will try to preserve the source port if possible. It will only change if it needs to do it to avoid a session clash.

The first device trying to use source-port 54321 will be source-NATed to the same source port as long as it is not used. A second device initiating a session with the same source-port will be source-NATed to a different source port.

This can be verified with a bit of python scripting:

import socket as sock
s = sock.socket(sock.AF_INET, sock.SOCK_STREAM)
s.bind(("0.0.0.0", 54321) # explicitly request source port 54321 from OS)
s.connect(("93.184.216.34", 80)) # IP for www.example.com
# stop and check debugs now
s.close() # to close the session/socket

-> Now run the script (without doing "s.close()" yet) on two clients, and check how the sessions get source-NATed.

The resulting NAT situation can be checked in FortiOS CLI with "get sys session list":

# get sys session list | grep 93.184.216.34
tcp 3598 10.19.5.147:54321 192.0.2.22:25738 93.184.216.34:80 -
tcp 3569 10.109.62.30:54321 192.0.2.22:54321 93.184.216.34:80 -
# note: Columns are: protocol | expiration time | source | source-NAT | destination | destination-NAT

Explanation:

Client 10.109.62.30 was the first to initiate a connection with source-port 54321 (it has shorter expiry time). You can see that the source-port is preserved post-SNAT in this case.

Client 10.19.5.147 was the second to initiate a connection with the same source-port 54321 to the same destination IP+port (important!), and as you can see the source-NAT port was moved because of it. (already "taken" by the first client)