FortiGate Administration Guide - FirewallShop.com

Firewall Virtual IP
Configuring virtual IPs
External Service Port
Map Port
The port traffic from the Internet will use. For a web server,
this will typically be port 80.
The port on which the server expects traffic. Since there is
only one port, leave the second field blank.
Figure 200:Virtual IP options; Static NAT port forwarding virtual IP for a single IP
address and a single port
4 Select OK.
To add static NAT virtual IP port forwarding for a single IP address and a
single port to a firewall policy
Add a external to dmz1 firewall policy that uses the virtual IP so that when users
on the Internet attempt to connect to the web server IP addresses, packets pass
through the FortiGate unit from the external interface to the dmz1 interface. The
virtual IP translates the destination addresses and ports of these packets from the
external IP to the dmz network IP addresses of the web servers.
1 Go to Firewall > Policy and select Create New.
2 Configure the firewall policy:
Source Interface/Zone external
Source Address
All (or a more specific address)
Destination Interface/Zone dmz1
Destination Address Port_fwd_NAT_VIP
Schedule
always
Service
HTTP
Action
ACCEPT
3 Select NAT.
4 Select OK.
Adding static NAT port forwarding for an IP address range and a port range
Ports 80 to 83 of addresses 192.168.37.4 to 192.168.37.7 on the Internet are
mapped to ports 8000 to 8003 of addresses 10.10.10.42 to 10.10.10.44 on a
private network. Attempts to communicate with 192.168.37.5, port 82 from the
Internet, for example, are translated and sent to 10.10.10.43, port 8002 by the
FortiGate unit. The computers on the Internet are unaware of this translation and
see a single computer at 192.168.37.5 rather than a FortiGate unit with a private
network behind it.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 315