NAT overload

[theglossy1]

Greetings. I am fairly new to Fortigate, but I have an extensive Cisco background, so hopefully someone can help me with some crossover translation. I am trying to figure out if it' s even possible on a Fortigate to hide certain IP ranges behind a particular address. It seems that using Virtual IP, I can create a range and hide it behind another range (e.g., hiding 10.1.1.1-10.1.1.15 behind 172.16.1.1-172.16.1.15). However, I want to hide 10.1.1.0/28 behind 172.16.1.1. I know the Fortigate maps everything behind the external interface' s address, but that' s not granular enough for my purposes. On a Cisco firewall this is very easy, and it is called NAT overload, aka PAT, and is done with the following commands (pre-version 8.2): nat (inside) 1 10.1.1.0 255.255.255.240 nat (inside) 2 10.1.1.16 255.255.255.240 global (outside) 1 172.16.1.1 global (outside) 2 172.16.1.2 The above would hide 10.1.1.0/28 behind 172.16.1.1 and 10.1.1.16/28 behind 172.16.1.2. Checkpoint allows this too, as do most other firewalls. Please tell me that Fortigate allows it, but it' s just not obvious where (but if it doesn' t allow it, tell me that too!) :) Thanks, Matt

[rwpatterson]

Welcome to the forums. Well not being from a Cicso background, perhaps I can still assist. What you' re trying to do is hide an IP range on the Inside behind a single IP address on the outside. That would translate to an IP pool in Fortiland. Create a pool with the single address, and when building the policy, check the NAT box, check the IP pool box and select that IP pool from the drop down which will be next to it. Hope that' s what you' re looking for. Addition: The IP pools are under ' Firewall > Virtual IP' .

[billp]

Matt, I don' t use this feature, so I' m taking an educated guess on this one. I think you are looking for VIP load balancing, per the manual:

Dynamic, one-to-many NAT mapping: an external IP address is translated to one of the mapped IP addresses. For each session, a load balancing algorithm dynamically selects an IP address from the mapped IP address range to provide more even traffic distribution. The external IP address is not always translated to the same mapped IP address.

It' s listed under Firewall then VIP in the CLI reference found here: http://docs.fortinet.com/fgt/handbook/cli_html/wwhelp/wwhimpl/js/html/wwhelp.htm

[rwpatterson]

Dangit, I' m backwards...

[ede_pfau]

No dangit here, both Bills are right! It depends on your scenario. a) you want to NAT incoming traffic from a single IP address to a subnet. That' s a ' load-balancing VIP' in FortiOS. It performs destination NAT in a round-robin fashion. For the reply traffic, as long as no port translation is involved the return traffic gets (source) NATted to the correct external IP address (the VIP) b) you want outgoing traffic from a subnet to be NATted to a single public address. That' s just NAT with an IP pool. It' s so common that NAT to the IP address of the outgoing WAN interface is enabled just by checking ' NAT' in the policy. If you want to have control over the externally used IP address, configure an IP pool (like rwpatterson posted). This is source NAT. Reply traffic will find it' s way back to the originating host on the inside. NAT is enabled in the policy / policies alone. Recently Fortinet added the Central NAT table to configure more complicated NAT scenarios, e.g. when the decision to NAT is based on source or destination port. But I don' t think this is the case with your setup.