Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
FOrtiBen
New Contributor

VIP source address question

Hi,

I have configured VIP (1:1 NAT) to allow external SFTP access from the internet into our server. The connection works but why the source address logged on the FTP server is the internal LAN IP address of the Fortigate instead of the actual src add of the SFTP client? Is this a normal behaviour of Fortigate? Is there a way to force the FortiGate not to replace the original src add?   

Thanks in advance.

3 REPLIES 3
Markus
Valued Contributor

Hi and welcome to the forums I assume you have Nat enabled. Just disable Nat on the policy. Best


________________________________________________________
--- NSE 4 ---
________________________________________________________

________________________________________________________--- NSE 4 ---________________________________________________________
ede_pfau

The NAT checkbox in the policy setup enforces source NAT to the address of the outbound interface. You only want to use VIP for destination NAT.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
FOrtiBen
New Contributor

Thank you all.  Unticking the NAT box on the policy works.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors