VIRTUAL IP NATTING

[Eric1]

Hello Everyone

I recently created a ipv4 policy connecting to our partner. the policy created is inside to outside; the source ip is from our internal network but we have NAT the private ip to public via virtual address and enabled NAT.

When we attempt to connect to our partner via icmp to see if they see our traffic logs, they note the public ip of the firewall but not the NAT ip associated with that public ip. I have placed the policy at the top but still they are unable to see our NAT public ip

The traffic is leaving my network and hits together with active sessions are noted, but on the other end they view my firewall public ip instead of the NAT ip

[funkylicious]

Hi,

In the FW policy I assume you have enabled NAT and selected, Use the outgoing interface address which basically tells it to use the IP addr configured on the exiting WAN intf.

If you want to use a specific NAT IP which is routed correctly back to you or part the network assigned to you by your ISP, the you would need to have created an IP Pool and in the fw policy select Use dynamic IP Pool and select the IP Pool you created previously or create it then.

[Christian_89]

Diagnose sniffer packet: This command allows you to capture traffic on a specific interface. You can also add filter options to capture only the desired traffic.
diagnose sniffer packet port1 'icmp'

[tthrilok]

Hi,

You may verify the NAT and if the traffic is matching the policy using:

di sys session filter clear
di sys session filter src x.x.x.x

di sys session filter dst y.y.y.y

di sys session list

x.x.x.x is the actual source and y.y.y.y is the destination you are trying to ping.

In the session output, please check the "policy_id=" 

++ Please check if you are having a one-one VIP created, from your firewall public IP to source?

[parteeksharma]

Hi @Eric1,

Kindly check the policy created for the VIP and  check if in that specific policy "VIP-address-Object" is called. Also please verify the interfaces in the VIP policy. To check and troubleshoot the VIP flow related issue please check below article:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Troubleshooting-VIP-issues/ta-p/2276...

Regards,
Parteek

[Eric1 · Accepted solution]

Hi Guys

It has worked, thanks for all the suggestions, i tried and its okay.

Thanks