Configuring DNAT

The following example shows how to configure Destination Network Address Translation (DNAT) using a virtual IP on a FortiGate in Transparent Mode:

config firewall vip

edit "vip1"

set extip 192.168.183.48

set extintf "vlan160_p2"

set mappedip 192.168.182.78

next

end

config firewall policy

edit 4

set srcintf "vlan160_p2"

set dstintf "vlan18_p3"

set srcaddr "all"

set dstaddr "vip1"

set action accept

set schedule "always"

set service "ALL"

next

end

If the mappedip is on a different subnet than the management IP, the FortiGate must have a valid route to this destination

The sniffer trace below shows the destination IP 192.168.183.48 being translated to 192.168.182.78:

fgt300 (TP) # diagnose sniffer packet any "icmp" 4

interfaces=[any]

filters=[icmp]

4.126138 vlan160_p2 in 192.168.182.93 -> 192.168.183.48: icmp: echo request

4.126190 vlan18_p3 out 192.168.182.93 -> 192.168.182.78: icmp: echo request

4.126196 port3 out 192.168.182.93 -> 192.168.182.78: icmp: echo request

4.126628 vlan18_p3 in 192.168.182.78 -> 192.168.182.93: icmp: echo reply

4.126661 vlan160_p2 out 192.168.183.48 -> 192.168.182.93: icmp: echo reply

4.126667 port2 out 192.168.183.48 -> 192.168.182.93: icmp: echo reply