FortiGate Administration Guide - FirewallShop.com

Double NAT: combining IP pool with virtual IP
Firewall Virtual IP
To allow the local users to access the server, you can use fixed port and IP pool to
allow more than one user connection while using virtual IP to translate the
destination port from 8080 to 80.
To create an IP pool
1 Go to Firewall > Virtual IP > IP Pool.
2 Select Create New.
3 Enter the following information and select OK.
Name
pool-1
Interface
DMZ
IP Range/Subnet 10.1.3.1-10.1.3.254
To create a Virtual IP with port translation only
1 Go to Firewall > Virtual IP > Virtual IP.
2 Select Create New.
3 Enter the following information and select OK.
Name
server-1
External Interface Internal
Type
Static NAT
External IP
Address/Range
172.16.1.1
Note this address is the same as the server address.
Mapped IP
172.16.1.1.
Address/Range
Port Forwarding Enable
Protocol
TCP
External Service Port 8080
Map to Port 80
To create a firewall policy
Add an internal to dmz firewall policy that uses the virtual IP to translate the
destination port number and the IP pool to translate the source addresses.
1 Go to Firewall > Policy and select Create New.
2 Configure the firewall policy:
Source Interface/Zone internal
Source Address 10.1.1.0/24
Destination Interface/Zone dmz
Destination Address
server-1
Schedule
always
Service
HTTP
Action
ACCEPT
3 Select NAT.
4 Select OK.
FortiGate Version 3.0 MR5 Administration Guide
328 01-30005-0203-20070830