Fine-tuning source port behavior for SNAT 7.4.4

This information is also available in the FortiOS 7.4 Administration Guide: Central SNAT

FortiOS supports maintaining or altering the original source port in SNAT using the port-preserve command:

• When port-preserve is enabled, SNAT will use the original source port if it is not already in use. This is the default.

• When port-preserve is disabled, SNAT will always change the source port to use the next higher, available port in the range. When the highest available port is reached, the counter will roll back to the first available port in the range. This allows ports to remain free until the counter rolls back to them.

The port-preserve command is available for the central SNAT or for firewall policies when NAT is enabled.

Only ports within the source port range of 5117 to 65533 will be preserved. Anything below 5117 will be translated to a port higher than 5117 based on the internal SNAT source port algorithm. If your source port is less than 5117 and you want to preserve it, explicit port mapping must be used. For more information, see Explicit port mapping.

To configure source port behavior for central SNAT:

config firewall central-snat-map
    edit 1
        set port-preserve {enable | disable}
    next
end

To preserve the original source port in a firewall policy:

1. Enable original source port preservation in the policy:

   config firewall policy
       edit 2
           set srcintf "port7"
           set dstintf "port1"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set nat enable
           set port-preserve enable
       next
   end

2. Check the session after the first traffic passes through the FortiGate:

   # diagnose sys session list
   session info: proto=6 proto_state=01 duration=7 expire=3594 timeout=3600 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
   state=may_dirty src-vis
   statistic(bytes/packets/allow_err): org=165/3/1 reply=112/2/1 tuples=2
   tx speed(Bps/kbps): 21/0 rx speed(Bps/kbps): 14/0
   orgin->sink: org pre->post, reply pre->post dev=15->9/9->15 gwy=0.0.0.0/10.2.2.1
   hook=post dir=org act=snat 10.1.100.42:20042->172.16.200.155:2156(172.16.200.199:5162)
   hook=pre dir=reply act=dnat 172.16.200.155:2156->172.16.200.199:5162(10.1.100.42:20042)
   po/(before,after) 0/(0,0), 0/(0,0)
   src_mac=94:ff:3c:6e:d2:90  dst_mac=00:0c:29:3d:83:02
   misc=0 policy_id=2 pol_uuid_idx=16000 auth_info=0 chk_client_info=0 vd=1
   serial=0001cf04 tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=0x000001 no_offload
   no_ofld_reason:  mac-host-check disabled-by-policy
   total session: 1

   SNAT uses source port 5162.

3. Clear the old session.

4. Send traffic again with the same source port from the client.

5. Check the new session:

   # diagnose sys session list
   session info: proto=6 proto_state=01 duration=4 expire=3598 timeout=3600 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
   state=may_dirty src-vis
   statistic(bytes/packets/allow_err): org=165/3/1 reply=112/2/1 tuples=2
   tx speed(Bps/kbps): 41/0 rx speed(Bps/kbps): 28/0
   orgin->sink: org pre->post, reply pre->post dev=15->9/9->15 gwy=0.0.0.0/10.2.2.1
   hook=post dir=org act=snat 10.1.100.42:20042->172.16.200.155:2156(172.16.200.199:5162) 
   hook=pre dir=reply act=dnat 172.16.200.155:2156->172.16.200.199:5162(10.1.100.42:20042)
   pos/(before,after) 0/(0,0), 0/(0,0)
   src_mac=94:ff:3c:6e:d2:90  dst_mac=00:0c:29:3d:83:02
   misc=0 policy_id=2 pol_uuid_idx=16000 auth_info=0 chk_client_info=0 vd=1
   serial=0001d0bf tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=0x000001 no_offload
   no_ofld_reason:  mac-host-check disabled-by-policy
   total session: 1

   The same source port has been used.

To alter the original source port in a firewall policy:

1. Disable original source port preservation in the policy:

   config firewall policy
       edit 2
           set srcintf "port7"
           set dstintf "port1"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set nat enable
           set port-preserve disable
       next
   end

2. Check the session after the first traffic passes through the FortiGate:

   # diagnose sys session list
   session info: proto=6 proto_state=05 duration=34 expire=113 timeout=3600 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
   state=may_dirty
   statistic(bytes/packets/allow_err): org=269/5/1 reply=164/3/1 tuples=2
   tx speed(Bps/kbps): 4/0 rx speed(Bps/kbps): 2/0
   orgin->sink: org pre->post, reply pre->post dev=15->9/9->15 gwy=0.0.0.0/10.2.2.1
   hook=post dir=org act=snat 10.1.100.42:20042->172.16.200.155:2156(172.16.200.199:5149)
   hook=pre dir=reply act=dnat 172.16.200.155:2156->172.16.200.199:5149(10.1.100.42:20042)
   pos/(before,after) 0/(0,0), 0/(0,0)
   src_mac=94:ff:3c:6e:d2:90  dst_mac=00:0c:29:3d:83:02
   misc=0 policy_id=2 pol_uuid_idx=16000 auth_info=0 chk_client_info=0 vd=1
   serial=0004a004 tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=0x000001 no_offload
   no_ofld_reason:  disabled-by-policy
   total session: 1

   SNAT uses source port 5149.

3. Clear the old session.

4. Send traffic again with the same source port from the client.

5. Check the new session:

   # diagnose sys session list
   session info: proto=6 proto_state=01 duration=3 expire=3597 timeout=3600 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
   state=may_dirty
   statistic(bytes/packets/allow_err): org=165/3/1 reply=112/2/1 tuples=2
   tx speed(Bps/kbps): 49/0 rx speed(Bps/kbps): 33/0
   orgin->sink: org pre->post, reply pre->post dev=15->9/9->15 gwy=0.0.0.0/10.2.2.1
   hook=post dir=org act=snat 10.1.100.42:20042->172.16.200.155:2156(172.16.200.199:5151) 
   hook=pre dir=reply act=dnat 172.16.200.155:2156->172.16.200.199:5151(10.1.100.42:20042)
   pos/(before,after) 0/(0,0), 0/(0,0)
   src_mac=94:ff:3c:6e:d2:90  dst_mac=00:0c:29:3d:83:02
   misc=0 policy_id=2 pol_uuid_idx=16000 auth_info=0 chk_client_info=0 vd=1
   serial=0004a1a5 tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=0x000001 no_offload
   no_ofld_reason:  disabled-by-policy
   total session: 1

   A new source port has been used.

6. Clear the old session again.

7. Send traffic again with the same source port from the client.

8. Check the new session:

   # diagnose sys session list
   session info: proto=6 proto_state=01 duration=20 expire=3581 timeout=3600 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
   origin-shaper=
   reply-shaper=
   per_ip_shaper=
   class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
   state=may_dirty
   statistic(bytes/packets/allow_err): org=165/3/1 reply=112/2/1 tuples=2
   tx speed(Bps/kbps): 8/0 rx speed(Bps/kbps): 5/0
   orgin->sink: org pre->post, reply pre->post dev=15->9/9->15 gwy=0.0.0.0/10.2.2.1
   hook=post dir=org act=snat 10.1.100.42:20042->172.16.200.155:2156(172.16.200.199:5153)
   hook=pre dir=reply act=dnat 172.16.200.155:2156->172.16.200.199:5153(10.1.100.42:20042)
   pos/(before,after) 0/(0,0), 0/(0,0)
   src_mac=94:ff:3c:6e:d2:90  dst_mac=00:0c:29:3d:83:02
   misc=0 policy_id=2 pol_uuid_idx=16000 auth_info=0 chk_client_info=0 vd=1
   serial=0004a519 tos=ff/ff app_list=0 app=0 url_cat=0
   rpdb_link_id=00000000 ngfwid=n/a
   npu_state=0x000001 no_offload
   no_ofld_reason:  disabled-by-policy
   total session: 1

   Another new source port has been used.