Static DNAT to an Mapped IP Subnet

[johnlloyd13]

hi,

i need to convert the ASA static NAT on a subnet to FortiGate.

the FGT GUI doesn't allow me to add/configure a LAN subnet.

just wondering how to implement this?

do i configure individual LAN/mapped IP in a VIP, add to a VIP group to the same external/public IP?

can i also configure the same external/public IP for both DNAT and SNAT? does FGT allow this?

ASA:

object network obj_LAN_SUBNET
 subnet 172.16.1.0 255.255.255.0
 nat (inside,outside) static 89.1.1.1

FGT:

config firewall vip

edit "lan-vip-1"
set extip 89.1.1.1
set mappedip 172.16.1.1
set extintf "any"
end

edit "lan-vip-2"
set extip 89.1.1.1
set mappedip 172.16.1.2
set extintf "any"
end

config firewall vipgrp

edit "lan-vip-group"
set interface "any"
set member "lan-vip-1" "lan-vip-2"

edit DNAT 1
set srcintf "port 1" <<< WAN
set dstintf "port 2" <<< LAN
set srcaddr "all"
set dstaddr "lan-vip-group"
set service "all"
set schedule "always"
set logtraffic enable
set status enable
set action accept
set nat disable
end

[ozkanaltas]

Hello @johnlloyd13 ,

I don't have any experience with Cisco ASA, but FortiGate doesn't support configuration like yours. 

Because you want to translate the same public IP to a different private IPs. If you want to use them like that, you should configure port mapping also. 

Your second question: Yes, you can use your public IP addresses for both sides (DNAT and SNAT). But for snat, you should configure ip pool. 

[funkylicious]

if i recall correctly,  nat (inside,outside) static 89.1.1.1 , is for SNAT - all traffic from 172.16.1.0/24 towards the Internet to be NAT-ed with the public IP of 89.1.1.1 - you can achieve that with IP Pool or just using the exit interface if it's configured wth that IP.