NAT overload for Fortigate itself

[Scorpa]

Hello !

We have some strange problem:

We need to NAT for fortigate so it can get updates and so on but how to do it when we are using dynamic IP pools ?

Our scheme is easy: ISP-to-FW - private adresses, so we must NAT to dynamic ip-POOL with public IP. We are susessfully wrote plicy for our users, servers, port forwarding and so on, but unable to figure out hot to do it for fortiagte.

Could you help ? 

[Sunil_Panchal_NSE7]

dear friend, 

          Just connect Fortigate with the main ISP router with any public IP  address , and then for  local network create dynamic IP POOL for natting.

because natting is done for local internal network not for Fortigate . fortigate itself is router in NAT mode.

and it will take all updates automatically just check setting in FortiGuard setup.

[Scorpa]

Just to clarify, isp to border router, router to fortigate is connected via private ip addresses. We setted public ip in ip pool and use it for our internal network. But how to use it for fortigate? We cant connect to public segment directly.

[ede_pfau]

Go to System > Config > FortiGuard > Antivirus and IPS Options there is a setting called "Use override server address". Fill in the public IP address assigned to you by your ISP. Now the FGT will contact the FDS servers with the public IP address and receive updates.