Nat requires reboot

[#1]

Hi, I am new to using fortigate. We have two F800. And I am doing some tests with them. Right now I am experimenting with NAT. And there is one thing I have found very annoying. Every time I make a NAT change. It does not apply until I have restarted the aplliance. Does it work this way? Can I not make a NAT change in realtime? Do I have to restart the appliance for it to become active? I mean. I have setup a rule where all traffic from 10.1.204.49 going to 10.103.8.0/24 will be translated to 192.168.6.1 using ip-pool. If I in realtime remove nat from this rule. The source address will still be translated to 192.168.6.1 until I restart the firewall or clear all sessions. Which is not a possible option either. Because when these firewalls will be in production it is not possible to clear sessions during work hours. Am I wrong? Have I missed something or is this how fortigate works?

[#2]

When you change NAT settings, you may have to wait until your current session expires, before NAT becomes active. Once you have established a session on the fortigate, you will use the policy settings that were defined in the firewall policy when your session became active. After your expires you create a new session with the new settings. You can manually clear your session via CLI: diag sys session filter <destination or source ip address> diag sys session clear

[rwpatterson]

Try to disable/enable the policy.

[#4]

I did try disable/enable. Does nothing for NAT. It only disables enables traffic. When I enable the rule again it still do the same NAT. Even if I turned of NAT. But I will try the diag sys session filter. That might be what I need. /dancoh

[g3rman]

Alternatively you can insert a rule above your current rule with or without NAT. Traffic should then hit that new rule and " reset" .

[#6]

I have tried that. Does not work. For some reason NAT is still in place.

[FortiRack_Eric]

diag sys session clear must work, otherwise you are modifying the wrong firewall rule.

[#8]

Off course diag sys session clear work. But it' s not a practical option. As all sessions will be reset. But I will try with diag sys filter. That should be better.

[FortiRack_Eric]

Well you can always manually remove the sessions from the session table manually that hit the rule. or start a new browser, hence a new session By design (and luckily) changes to fw rules only affect new sessions. Cheers, Eric

[TopJimmy]

ORIGINAL: SecureLayers-Eric By design (and luckily) changes to fw rules only affect new sessions. Cheers, Eric

File that in the " Go to know" and " that explains a lot" section. Thanks!