ONE to One NAT

[Dawa]

Hi,

I am using Fortigate 101 E firewall.Actually I want to do one to one NAT and already got few public IPs from ISP. Now the problem is these Public IPs are in different range than WAN IP through which all internal devices accessing internet.My question is, Can we do One to One NAT even we have diffrent public ip range?

Thanks !! 

[Toshi_Esumi]

Not a problem. It's very common while an interface IP is x.x.x.x/30 the additional subnet is y.y.y.0/29 or something like that. ISP delivers packets destined to the /29 to your x.x.x.x interface. Your FGT can pick them up  and do VIP with static NAT for each /29 IP to individual internal device. And you can do the opposite direction with an ippool per IP and set SNAT.

[ede_pfau]

@Toshi: ...or rely on the automatic re-translation for outbound traffic through that VIP. Just test it, you'll see what I mean. No need for an extra policy with an IP pool.

[Toshi_Esumi]

I thought it would automatically work only for returning packets based on the sessions initiated with the out-to-in direction packets. And if the inside servers initiate new sessions toward the internet, those packets would have the interface IP for their source instead of VIP inside IPs unlike Cisco's static NAT, unless it's using Central NAT.

[Ashik_Sheik]

Yes, upto 5.6 we used to create SNAT pocliy for server  ..i have no idea in new versions .

Regds,

Ashik