FortiGate Administration Guide - FirewallShop.com

Viewing the virtual IP list
Firewall Virtual IP
Static NAT
Static NAT Port
Forwarding
Dynamic virtual
IPs
Server Load
Balancing
Server Load
Balancing port
forwarding
Static NAT virtual IPs map an external IP address or IP address range
on a source network to a mapped IP address or IP address range on a
destination network.
Static NAT virtual IPs use one-to-one mapping. A single external IP
address is mapped to a single mapped IP address. A range of external
IP addresses is mapped to a corresponding range of mapped IP
addresses. A given IP address in the source address range is always
mapped to the same IP address in the destination address range.
Static NAT port forwarding maps a single IP address or address range
and a single port number or port range on one network to a different
single IP address or address range and a different single port number
or port range on another network.
Static NAT port forwarding is also just called port forwarding. Static NAT
port forwarding virtual IPs use one-to-one mapping. A range of external
IP addresses is mapped to a corresponding range of mapped IP
addresses and a range of external port numbers is mapped to a
corresponding range of mapped port numbers.
Port forwarding virtual IPs can be used to configure the FortiGate unit
for port address translation (PAT).
If you set the external IP address of a virtual IP to 0.0.0.0, you create a
dynamic virtual IP in which any external IP address is translated to the
mapped IP address or IP address range.
Server load balancing maps a single IP on one network to up to eight
real server IPs on another network.
At least one real address must be added to use this feature.
Server load balancing with port forwarding maps a single IP address
and port number on one network to up to eight specific server
addresses and eight specific ports on another network.
You must add the virtual IP to a NAT firewall policy to actually implement the
mapping configured in the virtual IP. To add a firewall policy that maps addresses
on an external network to an internal network, you add an external to internal
firewall policy and add the virtual IP to the destination address field of the policy.
For example, if the computer hosting a web server is located on the internal
network, it might have a private IP address such as 10.10.10.42. To get packets
from the Internet to the web server, there must be an external address for the web
server on the Internet. Add a virtual IP to the firewall that maps the external IP
address of the web server on the Internet to the actual address of the web server
on the internal network. To allow connections from the Internet to the web server,
add an external to internal firewall policy and set the Destination Address to the
virtual IP.
Viewing the virtual IP list
To view the virtual IP list, go to Firewall > Virtual IP > Virtual IP.
Figure 194:Virtual IP list
FortiGate Version 3.0 MR5 Administration Guide
308 01-30005-0203-20070830