Outgoing NAT on two interfaces

[#1]

I have a quite complicated network setup with multiple interfaces. However, for the problem I want to describe the setup can be simplified to three interfaces: wan1, dmz1 and internal1. Hosts connected to dmz1 have public IP addresses and NAT is not used. Hosts connected to internal1 have private IP addresses and I want to use NAT on outgoing connections both to wan1 and to dmz1. And this does not work for me. Wan1 is 149.156.6.58/30, dmz1 is 149.156.24.1/27, internal1 is 10.200.0.1/16. I want the NATed IP address on outgoing connections to be visible as 149.156.24.6, on both interfaces. So I defined two IP pools, both containing the single address 149.156.24.6, one bound to interface wan1 and the other to dmz1. When I activate NAT with the above IP pool on interface wan1, it works OK. I can connect to the Internet and connections are coming from 149.156.24.6. However, I can' t get the same on interface dmz1. The connections simply don' t work, I get no response to pings. When I use NAT without any IP pool on dmz1, it works and I see the connections coming from 149.156.24.1 - but that' s not what I want. I want the same address to be used on connections to both interfaces. Do you know how to handle this problem? My device is Fortigate-200A with FortiOS 3.00-b0744(MR7 Patch 6)

[emnoc]

May I ask why do you need the same ip_address ? I' ve tried this before with 2 defined pool but using the same address. You will never get this to work. The 1st defined pool is what bounds that ip_address and interface. What I did was just use 2 ip-address and create a pool1 and pool2, pool1 cover all outbound NAT ( WAN ) and any traffic to the DMZ was bounded to pool2.

[rwpatterson]

All IP addresses from my 1000A are the same, and I only have one IP pool for outgoing (mail servers excluded). Don' t know if things work differently when your interfaces are only labeled ' port 1' - ' port 10' ...

[#4]

> May I ask why do you need the same ip_address ? Previously the network that is connected to internal1 was connected to dmz1 via a separate router doing NAT, and was visible as 149.156.24.6 everywhere (149.156.24.6 is within the address space of dmz1 network). Now we want to get rid of this second router, but we want to keep the same addressing scheme as it was previously, because of various ACLs and other things configured in many places. Also, there is always not enough public IP addresses, so nobody wants to waste them and use two where one would be sufficient. But it seems that I found a solution, or rather a workaround (as I firmly believe it' s a bug in FortiOS): I needed to add that 149.156.24.6 address as a secondary IP address on the dmz1 interface (I needed to set first the " allow-subnet-overlap" parameter to be able to do this). With this addition, everything works fine.

[red_adair]

humble Question: If a Packet can leave 2 Interfaces with the same IP, how can the reply packets do the Trick ? Magic Routing ? -R.

[#6]

I don' t understand what' s the problem with the reply packets. What the routing tables are for at all, actually? You have a router with three interfaces, connecting three networks. A packet is coming from interface internal1, source IP gets translated to some address X, that in my case belongs to the address space connected to interface dmz2, and goes out either via dmz2 or wan2. There is no problem with reply packets from dmz2 - the address X belongs to that network, so all that is needed is that the router responds to ARP requests for this address. As for wan2, since we have a working routing between wan2 and dmz2, the routers in wan2 network know that our router is the gateway to dmz2 address space, including address X. So if they see packets addressed to X, they send them to our router. It recognizes that X is the address it is using for NAT, so it just translates the address back and sends them to the originating host on internal1. Imagine there is no NAT at all and network on internal1 has public IP addresses. Then a packet coming from internal1 can go out on either dmz2 or wan2 - depending on which network it is addressed to - and has the same source IP in both cases. Will there be any problem with reply packets in that case? Using the same address for outgoing NAT on both interfaces just simulates this situation.

[emnoc]

Will if you get it working, please update this thread? I have about 3 FGT that I would like to consolidate down to one ip-address pool and in the same situtation as what you have going.

[#8]

I wrote it already above - I got it working when I added the address I want to NAT to as a secondary IP address on the interface where it wasn' t working. The only catch is that it is needed to enable " subnet overlapping" from CLI before you can add a secondary IP address from the same subnet that is already defined on the interface: config system settings set allow-subnet-overlap end (the above command is valid for FortiOS 3.0 MR7, for previous versions the command is a bit different, as I found from Fortigate documentation: config system global set allow-interface-subnet-overlap end)