FortiGate Administration Guide - FirewallShop.com

Configuring virtual IPs
Firewall Virtual IP
Figure 201:Static NAT virtual IP port forwarding for an IP address range and a port
range example
To add static NAT virtual IP port forwarding for an IP address range and a
port range
1 Go to Firewall > Virtual IP > Virtual IP.
2 Select Create New.
3 Use the following procedure to add a virtual IP that allows users on the Internet to
connect to a web server on the DMZ network. In our example the external
interface of the FortiGate unit is connected to the Internet and the dmz1 interface
is connected to the DMZ network.
Name
Port_fwd_NAT_VIP_port_range
External Interface external
Type
Static NAT
External IP Address/Range The external IP addresses must be static IP addresses
obtained from your ISP. This addresses must be unique, not
used by another host, and cannot be the same as the IP
address of the external interface the virtual IP will be using.
However, the external IP addresses must be routed to the
selected interface. The virtual IP addresses and the external
IP address can be on different subnets. When you add the
virtual IP, the external interface responds to ARP requests for
the external IP addresses.
Map to IP/IP Range The IP addresses of the server on the internal network.
Define the range by entering the first address of the range in
the first field and the last address of the range in the second
field.
Port Forwarding
Selected
Protocol
TCP
External Service Port The ports that traffic from the Internet will use. For a web
server, this will typically be port 80.
Map Port
The ports on which the server expects traffic. Define the
range by entering the first port of the range in the first field
and the last port of the range in the second field. If there is
only one port, leave the second field blank.
4 Select OK.
FortiGate Version 3.0 MR5 Administration Guide
316 01-30005-0203-20070830