Apply threat feed connectors as source addresses in central SNAT

FortiOS allows an IP address threat feed to be applied as a source address in central SNAT. This enhancement allows for more dynamic and responsive network security configuration.

The IP address threat feed can be applied in the GUI and the CLI:

• In the GUI, select a threat feed object from the IP Address Threat Feed section when creating and editing a policy.

  

• In the CLI, the IP address threat feed connector can be applied when configuring the central-snat-map.

Example

In the following example, an external IP list threat feed object will be created and used in a central SNAT map as the source address.

To apply a threat feed connector in central SNAT:

1. Create a threat feed IP list object:

   config system external-resource
       edit "External-iplist-central-snat"
           set type address
           set resource "http://172.16.200.55/ip_list_test/test-external-iplist-central-snat.txt"
       next
   end

   The threat feed list is as follows:

   10.1.100.22
   10.1.100.41
   2000:10:1:100::22
   2000:10:1:100::41

   See IP address threat feed for more information.

2. Apply the threat feed connector in a central SNAT map as the source address:

   config firewall central-snat-map
       edit 1
           set type ipv6
           set srcintf "port2"
           set dstintf "port1"
           set orig-addr6 "External-iplist-central-snat"
           set dst-addr6 "all"
       next
       edit 2
           set srcintf "port2"
           set dstintf "port1"
           set orig-addr "External-iplist-central-snat"
           set dst-addr "all"
       next
   end

3. Verify that the threat feed connector has been applied and taken effect:

   # diagnose firewall iprope list 10000d
   policy index=2 uuid_idx=8391 action=accept
   flag (8041100): nat sport use_src pol_stats
   flag3 (80): best-route
   flag4 (200): port-preserve
   schedule()
   cos_fwd=0  cos_rev=0
   group=0010000d av=00000000 au=00000000 split=00000000
   host=0 chk_client_info=0x0 app_list=0 ips_view=0
   misc=0
   zone(1): 8 -> zone(1): 7
   dest(1): 0.0.0.0-255.255.255.255, uuid_idx=8031,
   source external ip pool(1): 8390
   service(1):
           [0:0x0:0/(0,65535)->(0,65535)] flags:0 helper:auto
   
   # diagnose firewall iprope6 list 10000d
   policy id: 1, group: 0010000d, uuid_idx=8163
     action: accept, schedule:
     cos_fwd=0 cos_rev=0
     flag (08041100): nat sport use_src pol_stats
     flag3(00000080): best-route
     shapers: / per_ip=
     sub_groups: av 00000000 auth 00000000 split 00000000 misc 00000000
     app_list: 0 ips_view: 0
     vdom_id: 0
     zone_from(1): 8
     zone_to(1): 7
     address_dst(1):
         all uuid_idx=8045
     source external ip pool(1):
         8390
     service(1):
         [0:0x0:0/(0,65535)->(0,65535)] helper:auto
     nat(0):
     nat_64(0):

   The source external IP pool is attached.

   # diagnose sys external-address-resource list
   List of external address resources:
   name:External-iplist-central-snat, uuid-idx:8390, num of ipv4/ipv6 ranges:2/2, used:yes
   
   # diagnose sys external-address-resource list External-iplist-central-snat
   IPv4 ranges of uuid-idx 8390 (num=2)
   10.1.100.22-10.1.100.22
   10.1.100.41-10.1.100.41
   IPv6 ranges of uuid-idx 8390 (num=2)
   2000:10:1:100::22-2000:10:1:100::22
   2000:10:1:100::41-2000:10:1:100::41

   The external IP list UUID index matches.

4. Verify that sending packets from IP addresses included in the IP list will hit the central SNAT map and that SNAT will take effect:

   1. Send packets from an IPv4 address that is included in the IP list. In this example, the packets are sent from 10.1.100.41.

      # diagnose sniffer packet any icmp 4
      interfaces=[any]
      filters=[icmp]
      7.269689 port2 in 10.1.100.41 -> 172.16.200.55: icmp: echo request
      7.269727 port1 out 172.16.200.6 -> 172.16.200.55: icmp: echo request
      7.269850 port1 in 172.16.200.55 -> 172.16.200.6: icmp: echo reply
      7.269861 port2 out 172.16.200.55 -> 10.1.100.41: icmp: echo reply
      ...
      8 packets received by filter
      0 packets dropped by kernel

      SNAT will take effect. The outgoing packet is SNAT'd to the IP address of the port1 interface.

   2. Send packets from an IPv4 address that is not included in the IP list. In this example, the packets are sent from 10.1.100.11.

      # diagnose sniffer packet any icmp 4
      interfaces=[any]
      filters=[icmp]
      2.323329 port2 in 10.1.100.11 -> 172.16.200.55: icmp: echo request
      2.323362 port1 out 10.1.100.11 -> 172.16.200.55: icmp: echo request
      ...
      4 packets received by filter
      0 packets dropped by kernel

      SNAT will not take effect.

   3. Send packets from an IPv6 address that is included in the IP list. In this example, the packets are sent from 2000:10:1:100::41.

      # diagnose sniffer packet any icmp6 4
      interfaces=[any]
      filters=[icmp6]
      2.105798 port2 in 2000:10:1:100::41 -> 2000:172:16:200::55: icmp6: echo request seq 1 [flowlabel 0x204d4]
      2.105844 port1 out 2000:172:16:200::6 -> 2000:172:16:200::55: icmp6: echo request seq 1 [flowlabel 0x204d4]
      2.105959 port1 in 2000:172:16:200::55 -> 2000:172:16:200::6: icmp6: echo reply seq 1 [flowlabel 0xebd44]
      2.105971 port2 out 2000:172:16:200::55 -> 2000:10:1:100::41: icmp6: echo reply seq 1 [flowlabel 0xebd44]
      ...
      8 packets received by filter
      0 packets dropped by kernel
      

      SNAT will take effect. The outgoing packet is SNAT'd to the IPv6 address of the port1 interface.

   4. Send packets from an IPv6 address that is not included in the IP list. In this example, the packets are sent from 2000:10:1:100::11.

      # diagnose sniffer packet any icmp6 4
      interfaces=[any]
      filters=[icmp6]
      1.917946 port2 in 2000:10:1:100::11 -> 2000:172:16:200::55: icmp6: echo request seq 1
      1.917979 port1 out 2000:10:1:100::11 -> 2000:172:16:200::55: icmp6: echo request seq 1
      ...
      8 packets received by filter
      0 packets dropped by kernel

      SNAT will not take effect.