1

I have two LANs

  • LAN 1 - 192.168.250.0/24
  • LAN 2 - 192.168.21.0/24

There is a way to use static NAT to map an IP like 192.168.21.1 to a IP of LAN1 like 192.168.250.1?

The is critical to access some LAN1 IPs using IPs of LAN2. I'm testing using fortigate 30d (LAN1 and LAN2 interfaces).

I did:

  • Create IPv4 policy to permit subnet of LAN1 access LAN2 subnet (without NAT option enabled. I don't know how this option works. If its PAT or dynamic NAT or whatever.)
  • Create Virtual IP on the interface LAN1 to use external IP of LAN2 mapped to a IP of LAN1 itself.

Using wireshark I don't see any traffic translated. Am I missing something?

1

What you are planning to do is called "Destination NAT", and in FortiOS this is done with 'Virtual IPs' (VIPs).

1- create a VIP like this
name: dnat_LAN2_to_LAN1 external interface: LAN2
external IP: 192.168.21.10 (for example)
mapped IP: 192.168.250.23 (for ex.)
port forwarding: not enabled

2- create a policy with
source interface: LAN2
source address: LAN2_subnet
destination interface: LAN1
destination address: dnat_LAN2_to_LAN1
service, schedule: to your liking
NAT: not enabled

You can now ping 192.168.250.23 on LAN1 using the IP 192.168.21.10 on LAN2.
If you want to map several IPs:
- you can create multiple VIPs and put them into a 'VIP group' and use this in a policy, or
- you can define a range of 'external' addresses which are then mapped 1:1 to the 'mapped-to' range

Note that you do not have to translate the LAN1 source addresses to a LAN2 address to completely 'masquerade' it - the VIP will do that automatically, even for traffic originating from LAN1.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.