Fortigate – Internal Mapped IP of Other LAN Segment

fortigatesnat

I have two LANs

  • LAN 1 – 192.168.250.0/24
  • LAN 2 – 192.168.21.0/24

There is a way to use static NAT to map an IP like 192.168.21.1 to a IP of LAN1 like 192.168.250.1?

The is critical to access some LAN1 IPs using IPs of LAN2.
I'm testing using fortigate 30d (LAN1 and LAN2 interfaces).

I did:

  • Create IPv4 policy to permit subnet of LAN1 access LAN2 subnet (without NAT option enabled. I don't know how this option works. If its PAT or dynamic NAT or whatever.)
  • Create Virtual IP on the interface LAN1 to use external IP of LAN2 mapped to a IP of LAN1 itself.

Using wireshark I don't see any traffic translated. Am I missing something?

Best Answer

What you are planning to do is called "Destination NAT", and in FortiOS this is done with 'Virtual IPs' (VIPs).

1- create a VIP like this
name: dnat_LAN2_to_LAN1 external interface: LAN2
external IP: 192.168.21.10 (for example)
mapped IP: 192.168.250.23 (for ex.)
port forwarding: not enabled

2- create a policy with
source interface: LAN2
source address: LAN2_subnet
destination interface: LAN1
destination address: dnat_LAN2_to_LAN1
service, schedule: to your liking
NAT: not enabled

You can now ping 192.168.250.23 on LAN1 using the IP 192.168.21.10 on LAN2.
If you want to map several IPs:
- you can create multiple VIPs and put them into a 'VIP group' and use this in a policy, or
- you can define a range of 'external' addresses which are then mapped 1:1 to the 'mapped-to' range

Note that you do not have to translate the LAN1 source addresses to a LAN2 address to completely 'masquerade' it - the VIP will do that automatically, even for traffic originating from LAN1.

Related Topic