translation behavior

[suthomas1]

Hi All, How does fortigate work with nat translation for any given rule. 1. If nat is enabled & no nat pool is selected, how does it take this & what interface is used? 2. If nat is enabled & destination interface option is taken, what happens? 3. If nat is enabled & no pool is given, will the rule be excepted Thanks in advance.

[emnoc]

1. If nat is enabled & no nat pool is selected, how does it take this & what interface is used?

the outgoing interface would be using for the sNAT, hiding the client behind that interface address

2. If nat is enabled & destination interface option is taken, what happens?

Not 100% sure on what you mean destination interface, but if fwpolicy has NAT selected the source would be NAT. If your talking about DNAT and a VIP, the destination would be translated automatically by the VIP and NAT is not enable nor required by the fwpolicy

3. If nat is enabled & no pool is given, will the rule be excepted

yes , see #1. You don' t need to have a nat-pool in all rules for network address translations

[Dipen]

If NAT (also call hide NAT or Source NAT as it alters the Source IP) is enabled then you have only two Options ##Either use destination Interface IP (default and when no NAT Pool is defined) ## Either use a NAT Pool (Single IP also to be defined as a Pool only) If you want NoNAT simply disable NAT. Just a confusion of terminology between Cisco / Fortinet / Checkpoint

[suthomas1]

Thank you for the reply. Is there any command to check the nat translations.

[emnoc]

Yes you can check in the gui or cli diag sys session stat get sys perform status ( also very good for rate and usage info, doesn' t get any NAT details ) get system session list With some script and greping you can build list of NAT with the last cli cmd

[suthomas1]

thank you, But, will these show the actual nat tables as nat is happening in live traffic? are we able filter the session list to only few particular ones, instead of viewing the entire list with this command grep doesn' t seem to work. an eg would be great help.

[emnoc]

yes, by applying a filter option e.g diag sys session filter vd Index of virtual domain. -1 matches all. sintf Source interface. dintf Destination interface. src Source IP address. nsrc NAT' d source ip address dst Destination IP address. proto Protocol number. sport Source port. nport NAT' d source port dport Destination port. policy Policy ID. expire expire duration duration proto-state Protocol state. clear Clear session filter. negate Inverse filter. I typically conduct this by known policy-ID