Hello all,
I am a Fortigate newb. The only documentation I can find on NAT over site to site IPSEC VPN pertains to versions before 5.6, and only to NATting entire subnets, on both ends.
I have a working IPSEC site to site VPN between my Fortigate (v.5.6) and a remote site (which is using a Cisco ASA.) I am trying to make ONE host behind the fortigate, 10.0.100.198, appear to the remote site as 192.168.114.6. Could someone tell me, precisely, what I'm supposed to do to make this happen? I have experimented with Virtual IPs and IP pools, but nothing seems to work. It's probably something simple that I'm missing. If it helps, in Cisco language, this is what I'm trying to accomplish:
object-group network external network-object host X.X.X.X object network internal host 10.0.100.198 object network translated_address host 192.168.114.6 (This is what I want the remote site to see 10.0.100.198 as) nat (inside,outside) 1 source static internal translated_address destination static external external
Thanks!
Update: I was able to NAT a private address to a static address assigned by my ISP, and hit the web server from outside, through the wan interface:
config firewall policy
edit 5
set name "Web Server"
set srcintf "port2"
set dstintf "port1"
set srcaddr "all"
set dstaddr "Public VIP Group"
set action accept
set status disable
set schedule "always"
set service "ALL"
set logtraffic all
next end
config firewall vipgrp
edit "Public VIP Group"
set interface "port2"
set member "Public PC VIP"
next
end
config firewall vip
edit "Public PC VIP"
set extip 172.216.8.195
set extintf "port2"
set mappedip "10.0.100.198"
next end
I just can't figure out how to do this over a site to site IPSEC VPN, using a static IP of my choice (instead of one assigned by my ISP - 172.216.8.195.)
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Okay let me clearified if this is a rt-base-vpn you need to apply the "SNAT" address in the vpn tunnel cfg
e.g
config vpn ipsec phase2 edit "YOURTUNNELNAMEHERE" set keylifeseconds 28000 set src-subnet 192.168.114.6/32 < the ippool address> set dst-subnet x.x.x.x./yy next end
PCNSE
NSE
StrongSwan
Just do it in a the fwpolicy and set a ippool
config firewall ippool edit "PUBSNAT" set startip 192.168.114.6 set endip 192.168.114.6 next
end
config firewall policy
edit 0 set srcintf "INTERNAL" set dstintf "RTBASEDVPNTUNNEL" set srcaddr "MYPRIVATEREALLADRESS" set dstaddr "THEWANREMOTESUNETADRESS" set action accept set schedule "always" set service "SSH" "HTTPS" PING set logtraffic all set nat enable set ippool enable set poolname "PUBSNAT" next
end
Make sure to use the SNAT in the phase2- SRCSUBNETS for the proxy-id
PCNSE
NSE
StrongSwan
emnoc,
Thank you so much for the reply! I tried your suggestion, but I still have something wrong. It's probably something foolish that I'm doing. I do have two policies for the tunnel, as I understand I am supposed to. I applied the NAT pool to the outgoing tunnel policy, as you suggested. Do I leave the incoming policy alone (without any NAT?)
When I initiate the tunnel, the remote site's log shows that it's trying to use 10.0.100.198 to build the tunnel, so it's failing on phase 2 because there is no match. In other words, it's not trying to use the translated address 192.168.114.6 to try and build the tunnel, like it should. I'm new to this so forgive me, but I'm not sure exactly what you mean by this:
Make sure to use the SNAT in the phase2- SRCSUBNETS for the proxy-id
Thanks again.
Okay let me clearified if this is a rt-base-vpn you need to apply the "SNAT" address in the vpn tunnel cfg
e.g
config vpn ipsec phase2 edit "YOURTUNNELNAMEHERE" set keylifeseconds 28000 set src-subnet 192.168.114.6/32 < the ippool address> set dst-subnet x.x.x.x./yy next end
PCNSE
NSE
StrongSwan
Thank you emnoc, this worked!
I needed an address pool with the SNAT IP, a virtual IP, (and group) and I had to specify the SNAT address in the phase 2 selectors (instead of the internal IP) like you said. In the outgoing policy for the tunnel, I enabled NAT and selected the IP pool. Then in the tunnel's incoming policy, I picked the VIP group for the destination. On to bigger things now. Thanks again!
Just remember route-based vpn can have the same features/function as any other interfaces
Ken
PCNSE
NSE
StrongSwan
Actually emnoc, doing this works for the tunnel, but it also disables local internet access for the host that I NATted. Am I missing something?
Not sure what you mean local access. The nat rule should be place on the tunnel only, so any traffic originating by the ( inside addresses ) will be SNAT'd.
Local access should not be impacted. Do you have a route or route all( 0.0.0.0/0 ) across the tunnel?
Ken
PCNSE
NSE
StrongSwan
The IP of the computer (ISlaptop1) that I want to NAT over the tunnel is 10.0.100.40. I want the remote site to see it as 192.168.114.7. The VPN works as expected. However, the computer (10.0.100.40) has no internet connection. If I disable the VPN policies, it immediately connects to the internet. It's probably something simple that I'm missing.
Port 1 is my LAN, Port 2 is WAN, and COMPANY is the VPN interface.
config router static edit 1 set dst 10.0.100.0 255.255.252.0 set gateway 10.0.110.1 set device "port1" next edit 2 set gateway X.X.X.X set device "port2" next edit 3 set device "COMPANY" set dstaddr "COMPANY_remote" next edit 4 set distance 254 set blackhole enable set dstaddr "COMPANY_remote" next end
config vpn ipsec phase2-interface edit "COMPANY" set phase1name "COMPANY" set proposal 3des-sha1 set pfs disable set src-addr-type name set dst-addr-type name set src-name "ISlaptop1 NAT" set dst-name "COMPANY_remote" next end
config vpn ipsec phase1-interface edit "COMPANY" set interface "port2" set peertype any set proposal aes256-sha1 set dhgrp 2 set remote-gw X.X.X.X set psksecret enc **** next
config firewall policy edit 6 set name "ISlaptop1 Outbound" set srcintf "port1" set dstintf "COMPANY" set srcaddr "ISlaptop1" set dstaddr "COMPANY_remote_subnet_1" set action accept set schedule "always" set service "ALL" set nat enable set ippool enable set poolname "ISlaptop1 Pool" next edit 1 set name "Outbound" set srcintf "port1" set dstintf "port2" set srcaddr "Public Network" set dstaddr "all" set action accept set schedule "always" set service "ALL" set nat enable next edit 3 set name "vpn_COMPANY_remote" set srcintf "COMPANY" set dstintf "port1" set srcaddr "COMPANY_remote" set dstaddr "ISlaptop1 VIP" set action accept set schedule "always" set service "ALL" next end
config firewall ippool edit "ISlaptop1 Pool" set type one-to-one set startip 192.168.114.7 set endip 192.168.114.7 next end
config firewall vip edit "ISlaptop1 VIP" set extip 192.168.114.7 set extintf "any" set mappedip "10.0.100.40" next end
config firewall address edit "COMPANY_remote_subnet_1" set allow-routing enable set subnet 192.168.2.3 255.255.255.255 next
edit "ISlaptop1" set associated-interface "port1" set subnet 10.0.100.40 255.255.255.255 next end
config firewall addrgrp edit "COMPANY_remote" set member "COMPANY_remote_subnet_1" set allow-routing enable next end
The cli cmd diag debug flow it A quick eye ball seems okay but hat does a diag debug flow show
I would also use the /prefix address in the route table for iniitial test for the route
e.g
config router static
edit 0
set dst 192.168.2.3/32
set device COMPANY
end
Riun a cli-cmd get router info routing st afterwards
Ken
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1561 | |
1034 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.