Convert Cisco ASA Source/Destination Static NAT

[johnlloyd_13]

hi,

i have a cisco ASA that will convert to FG.

i saw a "NAT trick" configured wherein both the source and destination have a static NAT.

i only know about FG source NAT (SNAT) and destination NAT (DNAT).

how do i configure this in FG? is there a CLI equivalent for this kind of "NAT trick"?

nat (inside,outside) source static 10.14.8.5 185.1.2.5 destination static 10.15.0.1 89.25.8.12

[AEK]

Hi John

Can I ask where such NAT is used or for what can it be useful?

[johnlloyd_13]

hi,

this link will explain the destination NAT config use case in cisco ASA:

https://subrun.blogspot.com/2017/08/destination-nat-in-cisco-asa.html

i'll need to migrate this config into FG.

do you know how to configure this in a FG and achieve the same end result?

[AEK]

Hi John

Sorry I thought it was some kind of source NAT and destination NAT at the same time :)

Actually your document is about destination NAT and here are the different ways to do it on FortiGate:

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/728694/policy-with-destination-nat

[johnlloyd_13]

hi,

i read the link you gave but it didn't cover the source and destination NAT or two-way NAT type:

nat (inside,outside) source static 10.14.8.5 185.1.2.5 destination static 10.15.0.1 89.25.8.12

is there other fortinet document/link or if someone can give the "converted" command in CLI for the above?

[Peterwilliam123]

Hello!
I hope you will change using these code:

vbnet code
config firewall address
edit "source_nat"
set subnet 10.14.8.5 255.255.255.255
next
edit "destination_nat"
set subnet 10.15.0.1 255.255.255.255
next
end

config firewall policy
edit 0
set srcaddr "source_nat"
set dstaddr "destination_nat"
set action accept
next
end

This configuration creates two address objects, one for the source NAT and one for the destination NAT. Then, it sets up a firewall policy allowing traffic from the source NAT address to the destination NAT address. Adjust the names and IP addresses as needed for your network setup.
If it does not change go to the youtube.com see and see in the videos, i hope you will find the best trick.

[Nchandan]

Hi John!

The configuration you provided from Cisco ASA involves both source NAT and destination NAT, which can be achieved using VIPs and SNAT policies in FortiOS.

Here's how you can configure the equivalent of the provided Cisco ASA NAT trick in FortiOS:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati...

Hope it helps.

[AEK]

Hi @Nchandan 

How does it involve SNAT? I see only DNAT here.