Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

CLI Reference

config firewall vip

Use this command to configure 1-to-1 NAT rules.

You can use 1-to-1 NAT when you want to publish public or “external” IP addresses for FortiADC resources but want the communication among servers on the internal network to be on a private or “internal” IP address range.

1-to-1 NAT is supported for traffic to virtual servers. The address translation occurs before the ADC has processed its rules, so FortiADC server load balancing policies that match source address (such as content routing and content rewriting rules) should be based on the mapped address space.

The system maintains this NAT table and performs the inverse mapping when it sends traffic from the internal side to the external side.

Before you begin:

  • You must have read-write permission for firewall settings.

Syntax

config firewall vip

edit <name>

set extif <datasource>

set extip <class_ip>

set extport <integer>

set mappedip-min <class_ip>

set mappedip-max <class_ip>

set mappedport-min <integer>

set mappedport-max <integer>

set portforward {enable | disable}

set protocol {tcp | udp}

set status {enable | disable}

set traffic-group <datasource>

next

end

extif

Interface that receives traffic.

extip

Specify the first address in the range. The last address is calculated after you enter the mapped IP range.

extport

Specify the first port number in the range. The last port number is calculated after you enter the mapped port range.

mappedip-min

First address in the range.

mappedip-max

Last address in the range.

mappedport-min

First port in the range.

mappedport-max

Last port in the range.

portforward

Enable/disable port forwarding.

protocol

TCP or UDP

status

Enable or disable static nat status

traffic-group

Specify the traffic group name.

Example

FortiADC-VM # config firewall vip

FortiADC-VM (vip) # edit 1-to-1-NAT

Add new entry '1-to-1-NAT' for node 661

 

FortiADC-VM (1-to-1-NAT) # get

extif :

extip : 0.0.0.0

mappedip-min : 0.0.0.0

mappedip-max : 0.0.0.0

portforward : disable

traffic-group:

status: enable

 

FortiADC-VM (1-to-1-NAT) # set extif port4

FortiADC-VM (1-to-1-NAT) # set extip 198.51.100.10

FortiADC-VM (1-to-1-NAT) # set mappedip-min 192.0.2.10

FortiADC-VM (1-to-1-NAT) # set mappedip-max 192.0.2.19

 

FortiADC-VM (1-to-1-NAT) # get

extif : port4

extip : 198.51.100.10

mappedip-min : 192.0.2.10

mappedip-max : 192.0.2.19

traffic-group :

status : enable

portforward : disable

status: enable

 

FortiADC-VM (1-to-1-NAT) # end

 

 

config firewall vip

Use this command to configure 1-to-1 NAT rules.

You can use 1-to-1 NAT when you want to publish public or “external” IP addresses for FortiADC resources but want the communication among servers on the internal network to be on a private or “internal” IP address range.

1-to-1 NAT is supported for traffic to virtual servers. The address translation occurs before the ADC has processed its rules, so FortiADC server load balancing policies that match source address (such as content routing and content rewriting rules) should be based on the mapped address space.

The system maintains this NAT table and performs the inverse mapping when it sends traffic from the internal side to the external side.

Before you begin:

  • You must have read-write permission for firewall settings.

Syntax

config firewall vip

edit <name>

set extif <datasource>

set extip <class_ip>

set extport <integer>

set mappedip-min <class_ip>

set mappedip-max <class_ip>

set mappedport-min <integer>

set mappedport-max <integer>

set portforward {enable | disable}

set protocol {tcp | udp}

set status {enable | disable}

set traffic-group <datasource>

next

end

extif

Interface that receives traffic.

extip

Specify the first address in the range. The last address is calculated after you enter the mapped IP range.

extport

Specify the first port number in the range. The last port number is calculated after you enter the mapped port range.

mappedip-min

First address in the range.

mappedip-max

Last address in the range.

mappedport-min

First port in the range.

mappedport-max

Last port in the range.

portforward

Enable/disable port forwarding.

protocol

TCP or UDP

status

Enable or disable static nat status

traffic-group

Specify the traffic group name.

Example

FortiADC-VM # config firewall vip

FortiADC-VM (vip) # edit 1-to-1-NAT

Add new entry '1-to-1-NAT' for node 661

 

FortiADC-VM (1-to-1-NAT) # get

extif :

extip : 0.0.0.0

mappedip-min : 0.0.0.0

mappedip-max : 0.0.0.0

portforward : disable

traffic-group:

status: enable

 

FortiADC-VM (1-to-1-NAT) # set extif port4

FortiADC-VM (1-to-1-NAT) # set extip 198.51.100.10

FortiADC-VM (1-to-1-NAT) # set mappedip-min 192.0.2.10

FortiADC-VM (1-to-1-NAT) # set mappedip-max 192.0.2.19

 

FortiADC-VM (1-to-1-NAT) # get

extif : port4

extip : 198.51.100.10

mappedip-min : 192.0.2.10

mappedip-max : 192.0.2.19

traffic-group :

status : enable

portforward : disable

status: enable

 

FortiADC-VM (1-to-1-NAT) # end