Virtual IP, NAT, PAT

[Chris_Rowan]

I had to reconfigure a FG301B in NAT mode this morning. My first. We have about 50 FGs in operation, but they' re all in transparent mode bethind Cisco Pix firewalls. Since there was no Pix at the site I visited this morning, I opted to reconfigure the FG in NAT mode. I looked for the equivalent of PAT on the IP of the outside interface, but couldn' t find it. I fiddled around with the Virtual IP component (Firewall > Virtual IP) and the Central NAT Table (Firewall > Policy > Central NAT Table) but couldn' t figure it out. I finally just configured a policy and selcted " NAT" for the outbound policy and configured everything else pertty much as I had on all the other FGs in transparent mode. Much to my surprise, it worked. I' d really like someone to explain what' s going on, though. Is the FG running PAT on the IP of the outside interface now? I didn' t define a pool of addresses to run NAT on. We always do PAT on the IP of the outside interface on the Pixes. And what' s the Virtual IP component for, exactly?

[rwpatterson]

OK, the Virtual IP is a destination NAT. People on the outside point to this to get to a server on the inside. The NAT (and NAT pool) is a source NAT (if used subnet-subnet) or a PAT if one IP is used on the outside. This is what the source nodes appear to be to the outside of the box. (stapler....)

[ede_pfau]

Manuals are for whimps. NOT. * headdesk * You' re really daring to put a high-tech device into production without having a clue...glad it worked. If you really want to know what you' ve configured get the " FortiOS Handbook" for your version of FortiOS from http://docs.fortinet.com . There is a simple worded, clear cut paragraph on nearly every feature of FortiOS rounded up by a lot of real world examples. The most common scenarios (like yours) can be found by a glance at the table of contents. Really, really recommended. It would' ve taken you half an hour to get a secure feeling of what you were doing. After all, a FGT is a security device not a toy.