enter image description here

I have a small query with respect to NATing in Fortigate.I'm struck in particular by a scenario where the remote network allows users with a specific IP range with a specific port for RDP over a different set of physical links.

User( in LAN should connect to on remote network which is connected to Internal ports on Fortigate (Nor WAN since it is used for internet).

Link between Remote network firewall & Fortigate has been established ( I can ping remote firewall interace

Admin wants us to access over 3389 port via (allowed IPs on remote firewall).

So basically, user (ex:Source: need to access Destination via allowed IPs ( over physical link between Fortigate & remote firewall (

I have tried VIP (Static NAT) (Source NAT) port forwarding, IP Pool (Destination NAT), but no help.

Please advice how to proceed. It is a typical scenario , can we achieve it?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Jan 4, 2021 at 1:42

2 Answers 2


Under your Policy Rule to allow access from to

Simply select NAT then create a Pool and put IP range of

Key thing for this to work is you have route on your fortigate pointing to and finally knows lives back via

Thats a pretty standard rule and sounds achievable. Some packet captures may help you to debug the issue.

  • Hi Smith ,When using IP pools for NATing, there is a limitation that must be taken into account when configuring the pool. If the IP address(es) within the pool are different from the IP address(es) that are assigned to the interface communications based on those IP addresses will fail. For example if the IP addresses assigned to an interface are -, you cannot choose - for the IP pool. Feb 22, 2015 at 5:03

Yes I understand your scenario and your requirement ..to access resources on remote firewall on port RDP ie 3389 from fortigate 200d connected switch lan users

For your requirement no natting required. . Please configure static route in fortigate 200D as below

Ip route points towards gateway

And for reverse traffic static route in remote n /W firewall Ip route pointing towards gateway

And have a security policies in firewalls allowing traffic

Policy in fortigate 200D

Source interface : interface Port need to mention Destination interface : interface Port need to mention Source address : Destination address : Port :tcp-3389 Action : allow Security profiles : on

Now security policy in remote n/w firewall

Source interface : egress interfàe of firewall Destination interface :ingress interface of firewall Source address : Destination address : Port :3389/TCP Action : allowed Security profiles :on .

Now user of fortigate 200D lan users can access internal hosted server on remote network firewall on port 3389

For futher security if you wants to hide your ips then you can use source natting in fortigate 200D firewalls but to accomplish this you need to configure static route in fortigate 200d with destination as source nat pool pointing. Towards gateway

  • 1
    The RDP user needs to appear as which does require source NAT.
    – Zac67
    Jul 12, 2020 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.