VIP source address question

[FOrtiBen]

Hi,

I have configured VIP (1:1 NAT) to allow external SFTP access from the internet into our server. The connection works but why the source address logged on the FTP server is the internal LAN IP address of the Fortigate instead of the actual src add of the SFTP client? Is this a normal behaviour of Fortigate? Is there a way to force the FortiGate not to replace the original src add?   

Thanks in advance.

[Markus]

Hi and welcome to the forums I assume you have Nat enabled. Just disable Nat on the policy. Best

[ede_pfau]

The NAT checkbox in the policy setup enforces source NAT to the address of the outbound interface. You only want to use VIP for destination NAT.

[FOrtiBen]

Thank you all.  Unticking the NAT box on the policy works.