FortiGate Administration Guide - FirewallShop.com

Firewall Virtual IP
Configuring virtual IPs
To add static NAT virtual IP port forwarding for an IP address range and a
port range to a firewall policy
Add a external to dmz1 firewall policy that uses the virtual IP so that when users
on the Internet attempt to connect to the web server IP addresses, packets pass
through the FortiGate unit from the external interface to the dmz1 interface. The
virtual IP translates the destination addresses and ports of these packets from the
external IP to the dmz network IP addresses of the web servers.
1 Go to Firewall > Policy and select Create New.
2 Configure the firewall policy:
Source Interface/Zone external
Source Address
All (or a more specific address)
Destination Interface/Zone dmz1
Destination Address Port_fwd_NAT_VIP_port_range
Schedule
always
Service
HTTP
Action
ACCEPT
3 Select NAT.
4 Select OK.
Adding a server load balance virtual IP
In this example the IP address 192.168.37.4 on the Internet, is mapped to the
following servers behind the fortiGate unit, 10.10.123.42, 10.10.123.43, and
10.10.123.44. The IP address mapping is determined by the FortiGate unit’s load
balancing algorithm. Attempts to communicate with 192.168.37.4 from the
Internet are translated and sent to 10.10.10.42, 10.10.10.43, or 10.10.10.44 by
the FortiGate unit. The computers on the Internet are unaware of this translation
and see a single computer at 192.168.37.4 rather than a FortiGate unit with a
private network behind it.
Note: Server load balancing maps a single IP on one network to up to eight real server IPs
on another network. At least one real address must be added to use this feature
Figure 202:Server Load balance virtual IP
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 317