destination nat between real ip addresses

[Jose-Perez_Netics]

my issue is the following.

The customer is migrating to new DNS servers on DMZ, but they have too many endpoints on the LAN with old DNS servers (x.x.x.x) configured, they want to MAP the ip for the old DNS servers (x.x.x.x) to the new DNS servers (y.y.y.y)

This can be acomplished using DNAT with the following configuration

VIP:

set service "DNS"
set extip x.x.x.x
set mappedip y.y.y.y
set extintf LAN

after doing this, the DNS traffic going the old DNS servers is natted correctly, but the server x.x.x.x is still giving another services and after natting DNS traffic, Fortigate treats x.x.x.x as virtual IP and any other traffic going to x.x.x.x is dropped with the error "iprope_in_check() check failed on policy 0, drop"

is there a way to do this nat and still have another services on x.x.x.x without considering x.x.x.x as Virtual IP?

after doing this, 

[AEK]

Did you try to use portforward instead of "set service DNS"?

set portforward enable
set protocol udp
set extport 53
set mappedport 53

However I'm not sure if this will actually work because once you configure a VIP then from FG prospective it's like if the whole IP is now owned by FG (as per my understanding), so if you have two equipment on your network with the same IP its simply IP conflict (malfunction and bad design).

In case it doesn't work I think is better not using such workaround and use clean configuration instead.

For example you may change DHCP config to assign the new DNS server to your DHCP clients instead of the old one, and for hosts with static IP config you may take the required time to migrate them one by one.

[bkrishnan]

Hi,
Please follow the below article which might help to configure port forwarding only for DNS traffic
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-Virtual-IPs-to-configure-port-forwar...

[vbandha]

Hello @Jose-Perez_Netics ,

I believe from your description that other traffic going to end device is not reaching there. 

In addition to above suggestions, please try to disable 'arp-reply' in VIP:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-ARP-reply-setting-in-Virtual-IP-IP-Pool/ta...

If you create a VIP object with an IP which also belongs to an end device then fortigate would treat the IP as local IP if this setting is enabled. 

Regards,

Varun