config firewall vip

Use this command to configure 1-to-1 NAT rules.

You can use 1-to-1 NAT when you want to publish public or “external” IP addresses for FortiADC resources but want the communication among servers on the internal network to be on a private or “internal” IP address range.

1-to-1 NAT is supported for traffic to virtual servers. The address translation occurs before the ADC has processed its rules, so FortiADC server load balancing policies that match source address (such as content routing and content rewriting rules) should be based on the mapped address space.

The system maintains this NAT table and performs the inverse mapping when it sends traffic from the internal side to the external side.

Before you begin:

• You must have read-write permission for firewall settings.

Syntax

config firewall vip

edit <name>

set extif <datasource>

set extip <class_ip>

set extport <integer>

set mappedip-min <class_ip>

set mappedip-max <class_ip>

set mappedport-min <integer>

set mappedport-max <integer>

set portforward {enable | disable}

set protocol {tcp | udp}

set status {enable | disable}

set traffic-group <datasource>

next

end

extif	Interface that receives traffic.
extip	Specify the first address in the range. The last address is calculated after you enter the mapped IP range.
extport	Specify the first port number in the range. The last port number is calculated after you enter the mapped port range.
mappedip-min	First address in the range.
mappedip-max	Last address in the range.
mappedport-min	First port in the range.
mappedport-max	Last port in the range.
portforward	Enable/disable port forwarding.
protocol	TCP or UDP
status	Enable or disable static nat status
traffic-group	Specify the traffic group name.

Example

FortiADC-VM # config firewall vip

FortiADC-VM (vip) # edit 1-to-1-NAT

Add new entry '1-to-1-NAT' for node 661

FortiADC-VM (1-to-1-NAT) # get

extif :

extip : 0.0.0.0

mappedip-min : 0.0.0.0

mappedip-max : 0.0.0.0

portforward : disable

traffic-group:

status: enable

FortiADC-VM (1-to-1-NAT) # set extif port4

FortiADC-VM (1-to-1-NAT) # set extip 198.51.100.10

FortiADC-VM (1-to-1-NAT) # set mappedip-min 192.0.2.10

FortiADC-VM (1-to-1-NAT) # set mappedip-max 192.0.2.19

FortiADC-VM (1-to-1-NAT) # get

extif : port4

extip : 198.51.100.10

mappedip-min : 192.0.2.10

mappedip-max : 192.0.2.19

traffic-group :

status : enable

portforward : disable

status: enable

FortiADC-VM (1-to-1-NAT) # end