FortiGate Administration Guide - FirewallShop.com

Firewall Virtual IP
IP pools
IP Pools for firewall policies that use fixed ports
Some network configurations do not operate correctly if a NAT policy translates
the source port of packets used by the connection. NAT translates source ports to
keep track of connections for a particular service. Select fixed port for NAT
policies to prevent source port translation. However, selecting fixed port means
that only one connection can be supported through the firewall for this service. To
be able to support multiple connections, add an IP pool to the destination
interface, and then select dynamic IP pool in the policy. The firewall randomly
selects an IP address from the IP pool and assigns it to each connection. In this
case the number of connections that the firewall can support is limited by the
number of IP addresses in the IP pool.
Source IP address and IP pool address matching
When the source addresses are translated to the IP pool addresses, one of the
following three cases may occur:
Scenario 1: The number of source addresses equals that of IP pool
addresses
In this case, the FortiGate unit will always match the IP addressed one to one.
If you use fixed port in such a case, the FortiGate unit will preserve the original
source port. However, this may cause conflicts if more than one firewall policy
uses the same IP pool, or the same IP addresses are used in more than one IP
pool.
Original address
Change to
192.168.1.1 172.16.30.1
192.168.1.2 172.16.30.2
...... ......
192.168.1.254 172.16.30.254
Scenario 2: The number of source addresses is more than that of IP pool
addresses
In this case, the FortiGate unit translates IP addresses using a wrap-around
mechanism.
If you use fixed port in such a case, the FortiGate unit preserves the original
source port. But conflicts may occur since users may have different sessions
using the same TCP 5 tuples.
Original address
Change to
192.168.1.1 172.16.30.10
192.168.1.2 172.16.30.11
...... ......
192.168.1.10 172.16.30.19
192.168.1.11 172.16.30.10
192.168.1.12 172.16.30.11
192.168.1.13 172.16.30.12
...... ......
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 325