Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
mattw
New Contributor III

NAT: Translating only the 2nd octet

Hi,

 

I'm working with a customer who need to source NAT all traffic coming in on one interface and going out of another, but they only want to translate the 2nd Octet.

 

For example:

Real Source IPNATed Source IP
172.16.18.23172.20.18.23
172.16.63.115172.20.63.115
172.16.155.231172.20.155.231

 

 

The real sources will always be 172.16.x.x and they always want to NAT only the 2nd octet to 172.20.x.x, keeping the other octets the same.

 

FTG600Fs running 7.0.14 in policy NAT mode.

 

I don't believe this is possible but I would love for you to tell me otherwise?

 

Many thanks!

6 REPLIES 6
dbu
Staff
Staff

Are you referring to NAT pool ? If yes than it is possible to define the pool of the addresses (second octet you refer i believe is a subnet) to be used with NAT. So basically you have one subnet with source IPs and another one for NAT translation.

Regards!
If you have found a solution, please like and accept it to make it easily accessible for others.
mattw
New Contributor III

Hi @dbu and thank you for your quick response,

I guess it depends how the NAT pool operates? Will it do what I illustrated in my original post (only change the 2nd octet) or will it start at the bottom of the pool and work up like below?

 

So assuming the NAT pool is: 172.20.0.0/16, would it do this:

Order of ConnectionsReal Source IPNATed Source IP
1st connection172.16.18.23172.20.0.1
2nd connection172.16.63.115172.20.0.2
3rd connection172.16.155.231172.20.0.3

 

The client would like to be able to easily correlate the NATed IP to the real IP when looking at server logs.

dbu

If this is the case than you need to go with static mapping as @pminarik  mentioned.

Regards!
If you have found a solution, please like and accept it to make it easily accessible for others.
bavss
New Contributor


@dbu wrote:

Are you referring to NAT pool ? If yes than it is possible to define the pool of the addresses (second octet you refer i believe is a subnet) to be used with NAT. So basically you have one subnet with source IPs and another one for NAT translation.


I got this,...

omegle xender
pminarik
Staff
Staff

IP pools alone do not guarantee static X.X.a.b -> Y.Y.a.b mapping, but you should be able to use a VIP to force one-to-one SNAT as described here:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-VIP-range-for-SNAT-and-static-1-to-1-mappi...

[ corrections always welcome ]
mattw
New Contributor III

Many thanks @pminarik, that looks like it might work? I will test and reply back.

Thank you!

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors