7

enter image description here

I have a small query with respect to NATing in Fortigate.I'm struck in particular by a scenario where the remote network allows users with a specific IP range with a specific port for RDP over a different set of physical links.

User(192.168.60.0/24) in LAN should connect to 10.48.1.3 on remote network which is connected to Internal ports on Fortigate (Nor WAN since it is used for internet).

Link between Remote network firewall & Fortigate has been established (10.189.254.17-10.189.254.18). I can ping remote firewall interace 10.189.254.17.

Admin wants us to access 10.48.1.3 over 3389 port via 10.189.1.8-10.189.1.15 (allowed IPs on remote firewall).

So basically, user (ex:Source: 192.168.60.15 need to access Destination 10.48.1.4 via allowed IPs (10.189.1.8-10.189.1.15) over physical link between Fortigate & remote firewall (10.189.254.18-18.189.254.17).

I have tried VIP (Static NAT) (Source NAT) port forwarding, IP Pool (Destination NAT), but no help.

Please advice how to proceed. It is a typical scenario , can we achieve it?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 16:26
1

Under your Policy Rule to allow access from 192.168.60.15 to 10.48.1.4.

Simply select NAT then create a Pool and put IP range of 10.189.1.8-10.189.1.15.

Key thing for this to work is you have route on your fortigate pointing 10.48.1.4 to 10.189.254.17 and finally 10.189.254.17 knows 10.189.1.8-10.189.1.15 lives back via 10.189.254.18.

Thats a pretty standard rule and sounds achievable. Some packet captures may help you to debug the issue.

  • Hi Smith ,When using IP pools for NATing, there is a limitation that must be taken into account when configuring the pool. If the IP address(es) within the pool are different from the IP address(es) that are assigned to the interface communications based on those IP addresses will fail. For example if the IP addresses assigned to an interface are 172.16.100.1 -172.16.100.14, you cannot choose 10.11.12.50 - 10.11.12.59 for the IP pool. – Faizan Nizam Feb 22 '15 at 5:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.