NAT a single IP address through Site to Site VPN

[botsergeant]

Hello all,

I am a Fortigate newb.  The only documentation I can find on NAT over site to site IPSEC VPN pertains to versions before 5.6, and only to NATting entire subnets, on both ends. 

I have a working IPSEC site to site VPN between my Fortigate (v.5.6) and a remote site (which is using a Cisco ASA.)  I am trying to make ONE host behind the fortigate, 10.0.100.198, appear to the remote site as 192.168.114.6.  Could someone tell me, precisely, what I'm supposed to do to make this happen?  I have experimented with Virtual IPs and IP pools, but nothing seems to work.  It's probably something simple that I'm missing.  If it helps, in Cisco language, this is what I'm trying to accomplish:

object-group network external   network-object host X.X.X.X  object network internal   host 10.0.100.198 object network translated_address  host 192.168.114.6   (This is what I want the remote site to see 10.0.100.198 as) nat (inside,outside) 1 source static internal translated_address destination static external external

 Thanks!

Update: I was able to NAT a private address to a static address assigned by my ISP, and hit the web server from outside, through the wan interface:

config firewall policy    

edit 5        

set name "Web Server"        

set srcintf "port2"        

set dstintf "port1"        

set srcaddr "all"        

set dstaddr "Public VIP Group"        

set action accept        

set status disable        

set schedule "always"        

set service "ALL"        

set logtraffic all    

next end

config firewall vipgrp    

edit "Public VIP Group"        

set interface "port2"        

set member "Public PC VIP"    

next

end

config firewall vip    

edit "Public PC VIP"   

set extip 172.216.8.195      

set extintf "port2"        

set mappedip "10.0.100.198"    

next end

I just can't figure out how to do this over a site to site IPSEC VPN, using a static IP of my choice (instead of one assigned by my ISP - 172.216.8.195.)   

[emnoc]

Just do it in a the fwpolicy and set a  ippool

config firewall ippool     edit "PUBSNAT"         set startip 192.168.114.6         set endip 192.168.114.6     next

end

config firewall policy

    edit 0         set srcintf "INTERNAL"         set dstintf "RTBASEDVPNTUNNEL"         set srcaddr "MYPRIVATEREALLADRESS"         set dstaddr "THEWANREMOTESUNETADRESS"         set action accept         set schedule "always"         set service "SSH" "HTTPS" PING         set logtraffic all         set nat enable         set ippool enable         set poolname "PUBSNAT"     next

end

Make  sure to use the  SNAT in the phase2- SRCSUBNETS for the proxy-id

[botsergeant]

emnoc,

Thank you so much for the reply!  I tried your suggestion, but I still have something wrong.  It's probably something foolish that I'm doing.  I do have two policies for the tunnel, as I understand I am supposed to.  I applied the NAT pool to the outgoing tunnel policy, as you suggested.  Do I leave the incoming policy alone (without any NAT?) 

When I initiate the tunnel, the remote site's log shows that it's trying to use 10.0.100.198 to build the tunnel, so it's failing on phase 2 because there is no match.  In other words, it's not trying to use the translated address 192.168.114.6 to try and build the tunnel, like it should.  I'm new to this so forgive me, but I'm not sure exactly what you mean by this:

Make  sure to use the  SNAT in the phase2- SRCSUBNETS for the proxy-id

Thanks again.

[emnoc · Accepted solution]

Okay let me clearified if this is a  rt-base-vpn you need to apply the  "SNAT" address in the vpn tunnel cfg

e.g

config vpn ipsec phase2     edit "YOURTUNNELNAMEHERE"         set keylifeseconds 28000         set src-subnet 192.168.114.6/32    < the  ippool address>         set dst-subnet  x.x.x.x./yy     next end

[botsergeant]

Thank you emnoc, this worked! 

I needed an address pool with the SNAT IP, a virtual IP, (and group) and I had to specify the SNAT address in the phase 2 selectors (instead of the internal IP) like you said.  In the outgoing policy for the tunnel, I enabled NAT and selected the IP pool.  Then in the tunnel's incoming policy, I picked the VIP group for the destination.  On to bigger things now.  Thanks again!

[emnoc]

Just remember route-based vpn can have the same features/function as any other interfaces

Ken

[botsergeant]

Actually emnoc, doing this works for the tunnel, but it also disables local internet access for the host that I NATted.  Am I missing something? 

[emnoc]

Not sure what you mean  local access. The nat rule should be place on the tunnel only, so any traffic originating by the ( inside addresses ) will be SNAT'd.

Local access should not be impacted. Do you have a route or route all( 0.0.0.0/0 ) across the tunnel?

Ken

[botsergeant]

The IP of the computer (ISlaptop1) that I want to NAT over the tunnel is 10.0.100.40. I want the remote site to see it as 192.168.114.7. The VPN works as expected. However, the computer (10.0.100.40) has no internet connection. If I disable the VPN policies, it immediately connects to the internet. It's probably something simple that I'm missing.

Port 1 is my LAN, Port 2 is WAN, and COMPANY is the VPN interface.  

config router static edit 1 set dst 10.0.100.0 255.255.252.0 set gateway 10.0.110.1 set device "port1" next edit 2 set gateway X.X.X.X set device "port2" next edit 3 set device "COMPANY" set dstaddr "COMPANY_remote" next edit 4 set distance 254 set blackhole enable set dstaddr "COMPANY_remote" next end

config vpn ipsec phase2-interface edit "COMPANY" set phase1name "COMPANY" set proposal 3des-sha1 set pfs disable set src-addr-type name set dst-addr-type name set src-name "ISlaptop1 NAT" set dst-name "COMPANY_remote" next end

config vpn ipsec phase1-interface edit "COMPANY" set interface "port2" set peertype any set proposal aes256-sha1 set dhgrp 2 set remote-gw X.X.X.X set psksecret enc **** next

config firewall policy edit 6 set name "ISlaptop1 Outbound" set srcintf "port1" set dstintf "COMPANY" set srcaddr "ISlaptop1" set dstaddr "COMPANY_remote_subnet_1" set action accept set schedule "always" set service "ALL" set nat enable set ippool enable set poolname "ISlaptop1 Pool" next edit 1 set name "Outbound" set srcintf "port1" set dstintf "port2" set srcaddr "Public Network" set dstaddr "all" set action accept set schedule "always" set service "ALL" set nat enable next edit 3 set name "vpn_COMPANY_remote" set srcintf "COMPANY" set dstintf "port1" set srcaddr "COMPANY_remote" set dstaddr "ISlaptop1 VIP" set action accept set schedule "always" set service "ALL" next end

config firewall ippool edit "ISlaptop1 Pool" set type one-to-one set startip 192.168.114.7 set endip 192.168.114.7 next end

config firewall vip edit "ISlaptop1 VIP" set extip 192.168.114.7 set extintf "any" set mappedip "10.0.100.40" next end

config firewall address edit "COMPANY_remote_subnet_1" set allow-routing enable set subnet 192.168.2.3 255.255.255.255 next

edit "ISlaptop1" set associated-interface "port1" set subnet 10.0.100.40 255.255.255.255 next end

config firewall addrgrp edit "COMPANY_remote" set member "COMPANY_remote_subnet_1" set allow-routing enable next end

[emnoc]

The  cli cmd diag debug flow it  A quick eye ball seems okay but hat does a diag debug flow show

I would also use the /prefix address in the route table for iniitial test for the route

e.g

config  router  static

   edit  0

       set dst  192.168.2.3/32

       set device  COMPANY

   end

Riun a  cli-cmd get router info routing st afterwards

Ken