Fortinet FortiGate Series Administration Guide

Firewall Virtual IP Configuring virtual IPs
FortiGate Version 4.0 MR1 Administration Guide
01-410-89802-20090903 457
http://docs.fortinet.com/ • Feedback
To add a static NAT virtual IP with an IP address range to a firewall policy
Add a wan1 to dmz1 firewall policy that uses the virtual IP so that when users on the
Internet attempt to connect to the server IP addresses, packets pass through the
FortiGate unit from the wan1 interface to the dmz1 interface. The virtual IP translates the
destination addresses of these packets from the wan1 IP to the DMZ network IP
addresses of the servers.
1 Go to Firewall > Policy and select Create New.
2 Configure the firewall policy:
3 Select NAT.
4 Select OK.
Adding static NAT port forwarding for a single IP address and a single port
The IP address 192.168.37.4, port 80 on the Internet is mapped to 10.10.10.42, port 8000
on a private network. Attempts to communicate with 192.168.37.4, port 80 from the
Internet are translated and sent to 10.10.10.42, port 8000 by the FortiGate unit. The
computers on the Internet are unaware of this translation and see a single computer at
192.168.37.4, port 80 rather than a FortiGate unit with a private network behind it.
Figure 256: Static NAT virtual IP port forwarding for a single IP address and a single port
example
To add static NAT virtual IP port forwarding for a single IP address and a single port
1 Go to Firewall > Virtual IP > Virtual IP.
2 Select Create New.
Source Interface/Zone wan1
Source Address All (or a more specific address)
Destination
Interface/Zone
dmz1
Destination Address static_NAT_range
Schedule always
Service HTTP
Action ACCEPT

Fortinet FortiGate Series Specifications

General

Brand	Fortinet
Model	FortiGate Series
Category	Firewall
Language	English