inbound nat

[mremile]

Hello all,

I have a question.

We have a vpn site to site.

But I want to mask the external side with a different ip range.

for example : 192.168.1.0 --> 10.10.10.0

I only have access to the webinterface of our fortigate 110c.

How can I do this.

I already tried to change the nat setting in de policy external --> LAN with an dynamic pool.

But This is not working.

I created a VIP range.

This is working. I can now ping for example 10.10.10.1 which is beeing translated to 192.168.1.1.

But If i ping from the external side to internal I can see with wireshark the external (not natted) address as source.

Could anyone point me in the right direction ?

Thank YOU !

[Jeroen]

If you natted your addresses the route on the other side should have a route to your natted address en not to your real addresses. So i would suggest to check the routes on the other firewall.

[emnoc]

maybe a topology diagram would help to explain what and what source your ping and more on what you mean by the external side. But for local<>remote LAN you can do a combination of DNAT or SNAT. just make sure the NAT'd address is part of your proxy-ids and if a rt-based vpn, in the destination route table.

Also diag debug flow will shed light on what's going or not.