Internal mapped IP of other LAN segment (fortigate)

Question

I have two LANs

• LAN 1 - 192.168.250.0/24
• LAN 2 - 192.168.21.0/24

There is a way to use static NAT to map an IP like 192.168.21.1 to a IP of LAN1 like 192.168.250.1?

The is critical to access some LAN1 IPs using IPs of LAN2. I'm testing using fortigate 30d (LAN1 and LAN2 interfaces).

I did:

• Create IPv4 policy to permit subnet of LAN1 access LAN2 subnet (without NAT option enabled. I don't know how this option works. If its PAT or dynamic NAT or whatever.)
• Create Virtual IP on the interface LAN1 to use external IP of LAN2 mapped to a IP of LAN1 itself.

Using wireshark I don't see any traffic translated. Am I missing something?

Answer 1

What you are planning to do is called "Destination NAT", and in FortiOS this is done with 'Virtual IPs' (VIPs).

1- create a VIP like this
name: dnat_LAN2_to_LAN1 external interface: LAN2
external IP: 192.168.21.10 (for example)
mapped IP: 192.168.250.23 (for ex.)
port forwarding: not enabled

2- create a policy with
source interface: LAN2
source address: LAN2_subnet
destination interface: LAN1
destination address: dnat_LAN2_to_LAN1
service, schedule: to your liking
NAT: not enabled

You can now ping 192.168.250.23 on LAN1 using the IP 192.168.21.10 on LAN2.
If you want to map several IPs:
- you can create multiple VIPs and put them into a 'VIP group' and use this in a policy, or
- you can define a range of 'external' addresses which are then mapped 1:1 to the 'mapped-to' range

Note that you do not have to translate the LAN1 source addresses to a LAN2 address to completely 'masquerade' it - the VIP will do that automatically, even for traffic originating from LAN1.