I have two LANs

  • LAN 1 -
  • LAN 2 -

There is a way to use static NAT to map an IP like to a IP of LAN1 like

The is critical to access some LAN1 IPs using IPs of LAN2. I'm testing using fortigate 30d (LAN1 and LAN2 interfaces).

I did:

  • Create IPv4 policy to permit subnet of LAN1 access LAN2 subnet (without NAT option enabled. I don't know how this option works. If its PAT or dynamic NAT or whatever.)
  • Create Virtual IP on the interface LAN1 to use external IP of LAN2 mapped to a IP of LAN1 itself.

Using wireshark I don't see any traffic translated. Am I missing something?

1 Answer 1


What you are planning to do is called "Destination NAT", and in FortiOS this is done with 'Virtual IPs' (VIPs).

1- create a VIP like this
name: dnat_LAN2_to_LAN1 external interface: LAN2
external IP: (for example)
mapped IP: (for ex.)
port forwarding: not enabled

2- create a policy with
source interface: LAN2
source address: LAN2_subnet
destination interface: LAN1
destination address: dnat_LAN2_to_LAN1
service, schedule: to your liking
NAT: not enabled

You can now ping on LAN1 using the IP on LAN2.
If you want to map several IPs:
- you can create multiple VIPs and put them into a 'VIP group' and use this in a policy, or
- you can define a range of 'external' addresses which are then mapped 1:1 to the 'mapped-to' range

Note that you do not have to translate the LAN1 source addresses to a LAN2 address to completely 'masquerade' it - the VIP will do that automatically, even for traffic originating from LAN1.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.