Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
jfernandz
New Contributor II

When should I enable NAT for policies?

Hi everybody, I've got a FortiWiFi (which I think it's pretty similar to a FortiGate but with a WiFi interface, correct me if I'm wrong) and it's in NAT mode, so I'm wondering if has this something to do with the fact that I have had to enable NAT for some policies, to be able to reach equipments in one VLAN from another different VLAN.

 

I mean, to clarify, here a table with info about these VLANs

 

+-----------+-----------+-----------------+--------------------------------+---------------------------+ | VLAN ID   | interface  | IP/Netmask     | DHCP Range                       | Related address object  | +-----------+-----------+-----------------+--------------------------------+---------------------------+ | 10           | internal5  | 10.100.0.1/12 | 10.100.0.2-10.100.255.253 | 10.96.0.0/12                | +-----------+-----------+-----------------+--------------------------------+---------------------------+ | 20           | internal1  | 172.20.1.1/24 | 172.20.1.2-172.20.1.254     | 172.20.1.0/24              | +-----------+-----------+-----------------+--------------------------------+---------------------------+

 

So I've created a policy with the '172.20.1.0/24' address object as source and '10.96.0.0/12' address object as destination but apparently I have to enable NAT for that policy if I want to reach hosts in the VLAN 10, is this right? Why is this? 

 

Thank you all, and excuse my ignorance with networking topics if so.

 

PS: Obviously VLAN ID is just a way to tag every VLAN and it's more related with the switches in my network, but that's the setup that I've got.

13 REPLIES 13
rwpatterson
Valued Contributor III

Are you talking about enabling NAT (as in NAT mode vs transparent mode) on the entire firewall, or enabling NAT in the policies? BIG difference.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
compuls1v3

Ah, sorry about that.  Enabling NAT on the policy.

compuls1v3

rwpatterson wrote:

Are you talking about enabling NAT (as in NAT mode vs transparent mode) on the entire firewall, or enabling NAT in the policies? BIG difference.

Ah, sorry about that.  Enabling NAT on the policy.

Etctan
New Contributor

Currently I have same issue. Is there any way to disable NAT or without setting gateway?

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors