Static SNAT
In static SNAT all internal IP addresses are always mapped to the same public IP address. This is a port address translation, Since we have 60416 available port numbers, this one public IP address can handle the conversion of 60,416 internal IP addresses to the same service, where a service is defined by a specified protocol, destination IP address, and destination port.
FortiGate firewall configurations commonly use the Outgoing Interface address.
Sample configuration
The following example of static SNAT uses an internal network with subnet 10.1.100.0/24 (vlan20) and an external/ISP network with subnet 172.16.200.0/24 (vlan30).
When the clients in internal network need to access the servers in external network, We need to translate IP addresses from 10.1.100.0/24 to an IP address 172.16.200.0/24, In this example, we implement static SNAT by creating a firewall policy.
To configure static NAT:
-
Go to Policy & Objects > Firewall Policy and click Create New.
-
Configure the required policy parameters.
-
Enable NAT and select Use Outgoing Interface Address. For packets that match this policy, its source IP address is translated to the IP address of the outgoing interface.
-
If needed, enable Preserve Source Port to keep the same source port for services that expect traffic to come from a specific source port. Disable Preserve Source Port to allow more than one connection through the firewall for that service.
-
Click OK.