Support destination port matching of central SNAT rules

This information is also available in the FortiOS 7.4 Administration Guide: Central SNAT

Central SNAT rules now include the destination port for traffic matching when the protocols are TCP, UDP, or SCTP. When configuring central SNAT rules in the CLI, the set dst-port command can be used to specify the destination port range.

Example

In the following example, two central SNAT rules will be created:

• Rule 3 will have a destination port set and IP pool test-ippool4-3 applied.

• Rule 5 will have IP pool test-ippool4-1 applied but will not set the destination port.

Example traffic will then be passed to see how the rule is matched.

To test central SNAT rule destination port support:

1. Configure central SNAT rule 3 with the destination port range specified:

   config firewall ippool
       edit "test-ippool4-3"
           set startip 172.16.200.150
           set endip 172.16.200.150
       next
   end
   config firewall central-snat-map
       edit 3
           set srcintf "port24"
           set dstintf "port17"
           set orig-addr "all"
           set dst-addr "all"
           set protocol 6
           set nat-ippool "test-ippool4-3"
           set dst-port 80-443
       next
   end

2. Configure central SNAT rule 5:

   config firewall ippool
       edit "test-ippool4-1"
           set startip 172.16.200.151
           set endip 172.16.200.151
       next
   end
   config firewall central-snat-map
       edit 5
           set srcintf "port24"
           set dstintf "port17"
           set orig-addr "all"
           set dst-addr "all"
           set nat-ippool "test-ippool4-1"
       next
   end

3. Send HTTP traffic to pass through the FortiGate that is expected to match central SNAT rule 3. IP pool test-ippool4-3 will perform source NAT.

4. Check the session to review for expected behavior:

   # diagnose sys session list
   session info: proto=6 proto_state=01 duration=2 expire=3599 timeout=3600 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
   state=log may_dirty f00
   statistic(bytes/packets/allow_err): org=1800/31/1 reply=77304/60/1 tuples=2
   tx speed(Bps/kbps): 602/4 rx speed(Bps/kbps): 25854/206
   orgin->sink: org pre->post, reply pre->post dev=24->17/17->24 gwy=172.16.200.55/10.1.100.42
   hook=post dir=org act=snat 10.1.100.42:46731->172.16.200.55:80(172.16.200.150:46731)
   hook=pre dir=reply act=dnat 172.16.200.55:80->172.16.200.150:46731(10.1.100.42:46731)
   pos/(before,after) 0/(0,0), 0/(0,0)
   misc=0 policy_id=99 pol_uuid_idx=15864 auth_info=0 chk_client_info=0 vd=0
   serial=00003c37 tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=0x4000001 no_offload
   no_ofld_reason:  disabled-by-policy
   total session 1

5. Send PING traffic to pass through the FortiGate that is expected to match central SNAT rule 5. IP pool test-ippool4-1 will perform source NAT.

6. Check the session to review for expected behavior:

   # diagnose sys session list
   session info: proto=1 proto_state=00 duration=2 expire=59 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
   state=log may_dirty f00
   statistic(bytes/packets/allow_err): org=252/3/1 reply=252/3/1 tuples=2
   tx speed(Bps/kbps): 99/0 rx speed(Bps/kbps): 99/0
   orgin->sink: org pre->post, reply pre->post dev=24->17/17->24 gwy=172.16.200.55/10.1.100.42
   hook=post dir=org act=snat 10.1.100.42:36732->172.16.200.55:8(172.16.200.151:36732)
   hook=pre dir=reply act=dnat 172.16.200.55:36732->172.16.200.151:0(10.1.100.42:36732)
   misc=0 policy_id=99 pol_uuid_idx=15864 auth_info=0 chk_client_info=0 vd=0
   serial=00003f62 tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=0x4000001 no_offload
   no_ofld_reason:  disabled-by-policy
   total session 1