Policy based routing and NAT

[dgonzalez1985]

Hi, I have a situation with two Internet providers and I am using a policy route to force the traffic of a specific DMZ into the wan2 provider. Doing that i have internet connection, but it' s natting the outgoing traffic by default with the ip of the interface. Due to the requirements of an application, i need to nat some servers to specific ips, but with policy routing it seems standard policies are skipped and its not applying those rules. Can someone explain me how to implement static natting with PBR? P.D: this is the current firmware version of my firewall: v4.0,build0656,130211 (MR3 Patch 12) Thanks in advance, David

[Richard_Bartlett]

Irrespective of PBR, you' ve got two main choices for how your DMZ server will present itself when initiating flows to the WAN ports you direct it/them to. Either 1. If you have a Virtual-IP or Load-Balancer installed on the firewall, then as long as this covers all protocol ports, you' ll get this IP presented. 2. Using Virtual-IP-Pool you' ll get this IP presented (if the right Firewall-Policy rule is hit first). However if you' ve set anything in regards to Virtual-IP NAT or LoadBalancer then this takes precedence over any stated pool address/es. (A pool can be a singular IP). The session table (or diag sniff pack or diag debug flow) should confirm the NAT behaviour. If the above doesn' t help. Please state the direction of flow initiation in your requirement for NAT. This is important for what you might have to do beyond the above. Note, in the strictest sense, PBR on Fortinet (and many other platforms) will only engage if there is also a valid forwarding route statement that encompasses the destination address (for flows initiated by DMZ host). Such a route needn' t be the only statement nor the route of the highest worth. The default route also counts. If flows are initiated by the remote end, then ECMP will normally be relied on rather than PBR and return traffic (of that same flow) by the same interface that it came in by. I add this in case you' ve got a multi-homed (e.g. BGP announced) set of addresses shared across each ISP link. The ambiguity over this part of your original question may have been a factor of why it took longer for you to get a reply. :)

[Dipen]

Firstly the NAT part is configured in Firewall Policy and not Routing Policy. As Richard rightly said that you need to configure an IP-Pool under Firewall Objects and create a firewall rule separate for the specific servers you are talking about. In that firewall rule configure " NAT to IP-Pool" instead of " NAT to Interface" . The destination Interface in FW policy will be wan1 or wan2 as configured in Policy Route. The Firewall Rule should be kept above the other generic firewall rules. The Policy Route will determine the outgoing Interface and accordingly the Firewall Policy shall be triggered.