Outbound static NAT

[#1]

Hi all We are currently migrating from another firewall product to Fortigate (including a FortiManager). What I' m trying to achieve is the same NAT topology as before. Let' s assume the external IP of the firewall is x.y.z.100. I) Internal Server 10.1.2.10 should have IP number x.y.z.101 on the outside. II) Internal Server 10.1.2.11 should have IP number x.y.z.102 on the outside. III) Internal Server 10.1.2.11 should have IP number x.y.z.103 on the outside. IV) All other clients should have IP number x.y.z.104 on the outside (not the firewall' s IP address). For IV I assume it would be sufficient to create a dynamic IP Pool with only one address in it on the FortiGate and enable " NAT" and " Dynamic IP Pool" in FortiManager for the rules concerned. - Is this correct like this? - Also, would it be possible to set up several many-to-one NAT pools for different client IP ranges, so that different internal client groups always get mapped to the same NAT address? For the internal servers I' m a bit at a loss. I' ve tried with " virtual IP" settings but these seem to only work on connections inbound from the external interface. How can I get that to work from both sides, so that when one of the internal servers opens a connection to the Internet it get' s natted to it' s personal external IP address (Static NAT in " checkpoint lingo" )? Thanks a lot Lukas

[#2]

You can accomplish this using the " IP Pool" tab. (Using the 2.8 firmware) Just create an entry for each external IP address you wish to use for NAT, and then use that entry in the firewall policy. For example, just create an IP Pool entry with an appropriate name and using the IP address x.y.z.101. Then, create a rule from internal to external from the source IP adress 10.1.2.11 to ANY, enable NAT, then check Dynamic IP Pool and select the entry you just created. Make sure it' s before any other rules that NAT the whole internal subnet.

[#3]

Hi Brad Thanks for your reply. I had a quick look into it but I' m puzzled. I can create IP Pools all right, but in the rules the Dynamic IP Pool is just a checkbox, I can' t select a dynamic IP pool by name. Also, I' d actually need to do this from FortiManager, but I can only use dynamic IP pools on the device level, not on FortiManager' s policy editor? Any insights there?

[#4]

Are you using the 2.8 firmware? (For that matter, are IP Pools even an option in the 2.5 release? Sorry, it' s been about a year since I last used the 2.5 version :) Also, I seem to recall there being a problem with IP Pools and Zones if you' re using them. If you search these forums you may be able to find some more information.

[UkWizard]

bwerschler is right, it sounds like you are running 2.5. Pools didnt really work in 2.5 at all. Goto 2.8 MR9 if you can, it works okay.

[#6]

I' m running 2.8 MR9 (2.80, build 393) I simply just have a checkbox for dynamic IP pools, I can' t select a named dynamic IP pool, although I can create one via the Fortigate' s https interface. Same thing via FortiManager, I can create a dynamic IP pool via the device manager and give it a name, but in the policy manager the " dynamic IP pool" is again just a checkbox. Lukas

[#7]

So, your IP Pools don' t show up in the dropdown box in the firewall policies at all? Hmm... Did you make sure you selected " external" for the interface when you created the IP Pool? (they default to the internal interface, which is useless if you want to use an IP Pool on the external interface ;) Maybe try setting it via command line. Take note of the rule number in the firewall web gui you want to use with the IP Pool. Then, ssh or telnet into the Fortigate and type

config firewall policy

then type

edit <rulenum>

where <rulenum> is whatever number you noted above At the prompt type

set ippool enable

and hit <Enter>, then type in

set poolname " your_pool_name"

Type end, and the changes should take effect.

[#8]

Ok, I found something now... I was using dynamic zones instead of interface names (eg. a custom net-dmz zone consisting of ports 2 and 3 instead of the ports themselves) but apparently this functionality is broken as one can only select the ports and not the zones when creating a dynamic IP pool. The VPN manager didn' t work anymore for the same reason as I found out (VPN interfaces can only be ports and not zones in the manager). This seems like a huge bug to me? Anyway, I recreated the whole policy with ports instead of zones and I can assign the IP pools to the individual rules, ok. But my new problem is that I can only do it on the Fortigate directly, not in the policy manager of the FortiManager. In the latter, it is still just a checkbox and when applying a policy from the manager to the device, the IP pool field is reset to the default value of <ANY>, not the one manually selected before. Any ideas on that one? Thanks so far... Lukas

[#9]

Sorry, but I' ve never used FortiManager so I won' t be able to help you out with that one.