Configuring IP Mapping in regular mode
Configuring IP Mapping in regular mode (non-HA) requires configurations in three systems:
- FortiIsolator configuration
- FortiGate configuration
- Client system configuration
FortiIsolator configuration
Use the FortiIsolator CLI to configure port forwarding mappings. Use the fis-ipmap command in the following format:
set fis-ipmap <external_port> <internal_port> <external_IP_address>
For example,
-
set fis-ipmap 18443 18887 172.30.147.207
FortiGate configuration
Complete the following steps in the FortiGate UI.
- Go to Policy & Objects > Virtual IPs.
- Create two IPv4 virtual IPs with the following information:
-
IP-Mapping-443: <external_IP_address> > 10.160.12.207 (TCP: 12443 > 443)
e.g. 172.30.147.207 -> FIS_IP (TCP: 18443 > 443)
-
IP-Mapping-8887: <external_IP_address> > 10.160.12.207 (TCP: 12887 > 8887)
e.g. 172.30.147.207 -> 172.30.157.18 (TCP: 18887 > 8887)
This example uses the following:
- External_IP_address: 172.30.147.207
- FIS_IP: 172.30.157.18
Settings of ip-mapping-443:
Settings of ip-mapping-8887:
-
- Go to Policy & Objects > IPv4 Policy > Create New.
- Create an IPv4 policy that includes the two virtual IPs that you created.
Client system configuration
Complete the following steps on the client system (for example, Windows 10).
-
In Windows 10, launch CMD as administrator.
-
Use the following commands to add the FortiGate IP address to the routing table on the client system:
-
At the command prompt, type
route –p ADD <external_IP_address> Mask 255.255.255.255 <FGT_IP_address>For example,
route –p ADD 172.30.147.207 MASK 255.255.255.255 172.30.157.48 -
To confirm the setup, type
route print.
-
-
To verify that it works in a browser, browse to:
https://<external_IP_address>:<port_map_to_443>/isolator/https://www.fortinet.com
e.g.: https://172.30.147.207:18443/isolator/https://www.fortinet.com
