Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Administration Guide

    Home FortiGate / FortiOS 7.2.9 Administration Guide
    7.2.9
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.16
    7.0.15
    7.0.14
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.15
    6.4.14
    6.4.13
    6.4.12
    6.4.11
    6.4.10
    6.4.9
    6.4.8
    6.4.7
    6.4.6
    6.4.5
    6.4.4
    6.4.3
    6.4.2
    6.4.1
    6.4.0

    Destination NAT

    Destination NAT

    Network Address Translation (NAT) is the process that enables a single device, such as a router or firewall, to act as an agent between the internet or public network and a local or private network. This agent acts in real-time to translate the source or destination IP address of a client or server on the network interface. NAT can be subdivided into two types:

    • Source NAT (SNAT)

    • Destination NAT (DNAT)

    This section is about DNAT. For information about SNAT, see Source NAT.

    A virtual IP (VIP) maps external IP addresses to internal IP addresses for DNAT. See Configuring VIPs and Configuring VIP groups.

    The following types of VIPs can be created:

    Static VIP

    A virtual IP that maps an IP address or range to another IP address or range. Custom settings can allow the VIP to be filtered by Source Address and/or services, so that the VIP only applies to the filtered traffic. See Static virtual IPs.

    Static VIP with services

    A virtual IP that defines services for a single port number mapping. See Virtual IP with services.

    Static VIP with port forwarding

    A virtual IP that hides the port number for an internal server or maps several internal servers to the same public IP address. See Virtual IPs with port forwarding. See also .

    FQDN-based VIP

    A virtual IP mapped to an FQDN. See Configure FQDN-based VIPs.

    Virtual server load balancing

    A special type of virtual IP used to implement server load balancing. See Virtual server load balance.

    Virtual IPs can also be used for server load balance multiplexing. See Virtual server load balance multiplexing.

    Central DNAT

    Where DNAT is configured by creating virtual IPs and selecting the VIPs in firewall policies, central NAT is not configured in the firewall policy.

    Central NAT is enabled in System Settings. When enabled, the Policy & Objects tree displays the Central SNAT policy option. Use the Central SNAT policy to configure VIPs as separate objects. During use, FortiGate reads the enabled NAT rules from the top down, until it locates a matching rule. See Central DNAT.
    Previous
    Next

    Destination NAT

    Destination NAT

    Network Address Translation (NAT) is the process that enables a single device, such as a router or firewall, to act as an agent between the internet or public network and a local or private network. This agent acts in real-time to translate the source or destination IP address of a client or server on the network interface. NAT can be subdivided into two types:

    • Source NAT (SNAT)

    • Destination NAT (DNAT)

    This section is about DNAT. For information about SNAT, see Source NAT.

    A virtual IP (VIP) maps external IP addresses to internal IP addresses for DNAT. See Configuring VIPs and Configuring VIP groups.

    The following types of VIPs can be created:

    Static VIP

    A virtual IP that maps an IP address or range to another IP address or range. Custom settings can allow the VIP to be filtered by Source Address and/or services, so that the VIP only applies to the filtered traffic. See Static virtual IPs.

    Static VIP with services

    A virtual IP that defines services for a single port number mapping. See Virtual IP with services.

    Static VIP with port forwarding

    A virtual IP that hides the port number for an internal server or maps several internal servers to the same public IP address. See Virtual IPs with port forwarding. See also .

    FQDN-based VIP

    A virtual IP mapped to an FQDN. See Configure FQDN-based VIPs.

    Virtual server load balancing

    A special type of virtual IP used to implement server load balancing. See Virtual server load balance.

    Virtual IPs can also be used for server load balance multiplexing. See Virtual server load balance multiplexing.

    Central DNAT

    Where DNAT is configured by creating virtual IPs and selecting the VIPs in firewall policies, central NAT is not configured in the firewall policy.

    Central NAT is enabled in System Settings. When enabled, the Policy & Objects tree displays the Central SNAT policy option. Use the Central SNAT policy to configure VIPs as separate objects. During use, FortiGate reads the enabled NAT rules from the top down, until it locates a matching rule. See Central DNAT.
    Previous
    Next