HiddenOne

In my previous article, I covered how to configure NAT overload, or PAT, on a Fortigate firewall. This time around I will cover how to configure static NAT.

Static NAT is used to map one IP address to another. This is typically used to perform translations from public address space to private address space. Many organizations do not put servers directly on the internet. Instead the servers may sit on a private LAN, or even in a DMZ. Static NAT mappings are used in these cases to allow servers that are sitting behind a firewall to extend services to the Internet.

Static NAT Configuration

Fortigate firewalls call the static NAT function “Virtual IP Mapping”. These virtual IP mappings can be used for static or dynamic NAT; however I will only be covering static NAT with a one to one mapping relationship.
A new virtual IP mapping is created on the “Virtual IP” tab under Firewall -> Virtual IP. On the “Virtual IP” tab, click on the “Create New” button. This will bring you to the “Add New Virtual IP Mapping” page as shown below:

Fill in the following information:

• Name – This is a name that will uniquely identify this mapping. It may be easy to use the name of the server that mapping is for just to keep things simple.
• External Interface – This will almost always be set to “external” unless you have a different configuration.
• External IP Address/Range – Here you can enter either the first and last IP addresses in a range, or just a single IP address (Leaving the second text box empty). Remember to use the public IP address here.
• Internal IP Address/Range – Same as the external IP, except this time you will use the private IP address of the server.
• Port Forwarding – Only use this if people will be sending requests from the outside on one port, while your server will be listening on another. For example if people will be requesting web pages on port 80, but your server’s web server runs on port 8080.

Once you have configured the virtual IP mapping it is time to create the corresponding policy. This will be done by going to Firewall -> Policy and then the “Policy” tab. Click on the “Create New” button to create a new policy.

This time we are going to create a policy for traffic entering our network, so the source interface will be “external” and the destination interface will be “internal” (or DMZ depending on your configuration).

The next crucial step is to set the “Destination Address. If you expand the drop down menu, you will see a section titled “Virtual IP”, under which you should see the name of the “Virtual IP Mapping” that was just created. It’s also good practice to only accept traffic for the services that the server will be running. There is no use in accepting incoming HTTP for a server that only runs SMTP services, plus it’s a good security practice.

Finally, in this case you do not need to select “NAT”. The virtual IP mapping will take care of all of the NAT work.

Now you should be armed to configure all of the basic NAT services on a Fortigate.