FortinetConfig834 downloads

Fortinet FortiGate NAT Configuration

Central SNAT (source NAT pool), VIP (virtual IP / DNAT port-forwarding), and NAT policies for FortiGate firewalls.

What is it?

FortiGate supports two NAT models: policy-based NAT (enable 'nat' inside a firewall policy — uses outgoing interface IP as source) and central NAT (separate SNAT and DNAT tables, more flexible). Central SNAT uses IP pools for source translation. DNAT uses VIP (Virtual IP) objects that map an external IP/port to an internal server. VIPs are then referenced in firewall policies — the policy allows the traffic AND the VIP performs the translation. FortiOS evaluates VIPs before security policies for inbound traffic.

When to use

·Publishing internal servers to the internet (web servers, mail servers, remote desktop) — use VIP objects
·Multiple public IPs mapped to different internal servers — use separate VIP per server
·IP pool NAT when you need predictable source IPs (rather than interface IP) for outbound connections
·Central NAT mode when you need fine-grained control over NAT independent of firewall policies

When NOT to use

·VPN traffic — same as Palo Alto, NAT must not apply to IPSec traffic. Ensure VPN policies don't have 'nat enable'.
·If all you need is simple internet NAT — enable 'nat' in the outbound firewall policy, no VIP or IP pool needed

How it compares

vs Palo Alto NAT RulesPalo Alto uses separate NAT rules evaluated before security policy. FortiGate VIPs are referenced inside security policies — NAT and policy are linked. FortiGate central NAT mode is more similar to Palo Alto's approach.

vs Cisco ASA NATASA uses 'nat' and 'static' objects with complex syntax. FortiGate VIP objects are simpler. Both support hairpin NAT (access external IP from inside).

Prerequisites

→WAN interface must have the public IP assigned (or floating IP from ISP)
→VIP object must be created before referencing it in a firewall policy
→For central NAT: enable with 'config system settings > set central-nat enable' before creating SNAT maps
→Separate firewall policy needed to allow traffic to the VIP (from untrust to DMZ/internal)

Config Generator

Hostname *

IP Pools (for SNAT)

Virtual IPs (DNAT / Port-forward)

Central SNAT Policies

Verification commands

get firewall vip

List all VIP (DNAT) objects

ExpectedShows each VIP with extip, mappedip, and port-forward settings

diagnose firewall nat-pba-list

Show active NAT port block allocation sessions

ExpectedLists active SNAT sessions with source IP, translated IP, and port range

Debug commands

diagnose firewall iprope lookup <ext-ip> <dst-ip> <port> <port> 6 <wan-if>

Test if inbound traffic to VIP matches the expected policy

Common mistakes & fixes

SymptomVIP not working — external traffic not reaching internal server

CauseFirewall policy references the VIP in dstaddr but has wrong dstintf, or policy is missing entirely

FixThe policy for DNAT must have: srcintf=wan, dstintf=internal/dmz, dstaddr=VIP-object (not the real server). Verify with 'diagnose firewall iprope lookup'.

SymptomCentral SNAT not translating traffic

CauseCentral NAT mode not enabled, or SNAT map srcintf/dstintf doesn't match the traffic path

FixVerify central NAT is enabled: 'config system settings > get | grep central-nat'. Check SNAT map matches the exact srcintf and dstintf of the firewall policy.

Further learning

Recommended books to go deeper on this topic.

Cisco ASA: All-in-One Next-Gen Firewall, IPS, and VPN Services

Jazib Frahim, Omar Santos, Andrew Ossipov · Cisco Press · ASA NAT — object NAT, twice NAT, auto NAT, NAT order of operations

Kindle ↗Hardcover ↗