source nat for dmz interface

[create_share]

Hi,

How do we create one-to-one source nat policies in Fortigate 7.0.12? I cannot use the interface IP Address or dynamic pool. It must be one-to-one nat as per the destination network policy.

Source IP:           10.10.1.11 (Interface lan)

SNAT IP:             192.168.100.10

Destination IP:   10.172.1.20 (Interface DMZ)

Thanks.

[Toshi_Esumi]

step1. Put 192.168.100.10 in a new IP Pool.
step2. Create address objects for 10.10.1.11/32 and 10.172.1.20/32.

step3. Create a new policy from land to DMZ with the source 10.10.1.11 and destination 10.172.1.20 with NAT(SNAT) enabled + "Use Dynamic IP Pool" w/ the pool you created in step1.

step4. Move the new policy created in step3 to above existing policy from lan to DMZ.

If opposite direction of traffic from DMZ to lan exists (initiated from DMZ side), you need to create a VIP/DNAT to reverse the process and create a policy for that direction by specifing the VIP as destination address.

Toshi

[create_share]

Yes, I already did that. Just wondering if it was the correct way because getting exhausted pool message after selecting one-to-one Nat. After changing it to overload, the message disappeared.

[Toshi_Esumi]

I would ignore that warning as long as it's working. If you don't want to see it you can use overload. It shouldn't be a matter since you limited the source address to be only one IP in the policy. No other devices/IPs would be able to use the SNAT.

You want to accomplish "one-to-one NAT" operation, not necessary the FGT's "one-to-one IP Pool" configuration.

Toshi