Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
zarn
New Contributor

Many to one NAT and destination filtering Fortigate 100D

I have many to one NAT set up with one VLAN under the LAN interface uses the external IP of the fw for internet.

My switch connects to internet with the firewall WAN interface hooked up to it. On the switch I have routable hosts.

The problem i am having is I cannot make the rule granular and block access to certain routable ips on the switch. Once I uses the source and destination in the policy it does not allow me to make a new rule.

Also it does not seem like Fortigate supports negatives in rules (as in !10.10.10.10 - being NOT 10.10.10.10). So I am stuck with a rule allowing granularity of protocols allowed but not destinations (it's either all or nothing).

Is there any way to do this?

 

 

 

5 REPLIES 5
Toshi_Esumi
SuperUser
SuperUser

You just need to place an opposite rule for 10.10.10.10 first, let's say "deny", then place an "accept" rule for "all" right after it. It would accomplish "NOT 10.10.10.10/32", "accept" rule.

zarn

Actually I thought of that but it does not allow me to select these objects once used in one rule already....

 

Toshi_Esumi

No, you never need to use the object twice although it should be allowed. You must have created an address object like "10.10.10.10/32", then the first policy uses it as a destination to deny. Then the second policy uses "all" for the destination and set accept. That's all you need to do to "allow all destinations except 10.10.10.10". You can do the same with source addresses.

ede_pfau

At least in FOS v5.4 and v5.6, you can set an option in a policy to negate the source and/or destination address:

 

config firewall policy

   set srcaddr-negate               When enabled srcaddr specifies what the source address must NOT be.
   set dstaddr-negate               When enabled dstaddr specifies what the destination address must NOT be.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
Toshi_Esumi

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors