Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
CollabraIT
New Contributor II

Limited transparency

We have 1 FortiGate that handles the routing of our internal networks as well as the outside world. I'm looking for a way to allow server A on network A to know who server B on network B is when they communicate. With NAT on, when this communication happens, server A sees the communication as coming from the FortiGate instead of from server B. I need to be a to set something like an X-Forwarded-For header on the traffic, or be able to to NAT just the external traffic and set the inside networks to transparency. My understanding is that since we just have the single device which handles inside and outside, I have to have NAT but the FortiGate seems to only allow yes or no when it comes to NAT. 

Can anyone shed some light on this issue? 

2 Solutions
ede_pfau
SuperUser
SuperUser

Maybe you can post a small diagram of where the subnets are attached to the FGT. Until then, I can only guess.

 

NAT is done on a per-policy base. If you can split the traffic so that source net A and source net B go across different policies you can omit the NAT setting in one.

Again, to decide if you need NAT I'll have to have more infos.

 

Ede Kernel panic: Aiee, killing interrupt handler!

View solution in original post

Ede Kernel panic: Aiee, killing interrupt handler!
Kenundrum

Ede is correct- just disable NAT on appropriate rules.

 

Consider the following setup:

internet    public IP         wan1

network 1 10.10.10.0/24 port1 FGT address 10.10.10.1

network 2 10.10.20.0/24 port2 FGT address 10.10.20.1

 

What you want is something like network 2 -> network 1 no NAT (original source addresses appear), network 1 or network 2-> internet NAT

All you need to do is disable NAT on the policies that go from port1->port2 and vice versa. The FGT will be able to handle routing between the subnets because it is attached to both. Traffic destined for 10.10.10.12 from 10.10.20.22 will hit the Fortigate and go to port1, the source address will remain as 10.10.20.22 when it arrives. This also assumes your devices have their default gateway as the Fortigate.

CISSP, NSE4

 

View solution in original post

CISSP, NSE4
4 REPLIES 4
ede_pfau
SuperUser
SuperUser

Maybe you can post a small diagram of where the subnets are attached to the FGT. Until then, I can only guess.

 

NAT is done on a per-policy base. If you can split the traffic so that source net A and source net B go across different policies you can omit the NAT setting in one.

Again, to decide if you need NAT I'll have to have more infos.

 

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
CollabraIT
New Contributor II

Internal networks are going to to individual physical interfaces with external access on a WAN interface.

Kenundrum

Ede is correct- just disable NAT on appropriate rules.

 

Consider the following setup:

internet    public IP         wan1

network 1 10.10.10.0/24 port1 FGT address 10.10.10.1

network 2 10.10.20.0/24 port2 FGT address 10.10.20.1

 

What you want is something like network 2 -> network 1 no NAT (original source addresses appear), network 1 or network 2-> internet NAT

All you need to do is disable NAT on the policies that go from port1->port2 and vice versa. The FGT will be able to handle routing between the subnets because it is attached to both. Traffic destined for 10.10.10.12 from 10.10.20.22 will hit the Fortigate and go to port1, the source address will remain as 10.10.20.22 when it arrives. This also assumes your devices have their default gateway as the Fortigate.

CISSP, NSE4

 

CISSP, NSE4
CollabraIT

Thanks! That worked. I new I'd seen a NAT check box somewhere, but I'd thought it was on the interface and never went back to look at the policy rules.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors