Per-device and per-platform dynamic mapping

Some objects support per-device and/or per-platform dynamic mapping allowing you to set object configurations for specific devices or platforms.

In the GUI, when the Per-Device Mapping or Per-Platform Mapping options are available, you can expand the option and click Create New to configure the dynamic mapping.

When using dynamic mapping, the devices or platforms specified will receive the configurations specified in the dynamic mapping rule. Devices or platforms which do not match the dynamic mapping will receive the default configuration set for the object.

For more information about configuring normalized interfaces with dynamic mapping, see Normalized interfaces.

To configure a dynamic mapping using the CLI, the configuration for the mapping must be defined for the object using the dynamic_mapping (per-device mapping) and/or platform_mapping(per-platform mapping) command when available. CLI scripts must be run on a policy package instead of the device database. For information on running CLI scripts, see Scripts

Default mapping is only used when there is no per-device mapping for a particular device. You must have either a per-device mapping or a default mapping in a policy package. Otherwise, the policy package installation will fail. When you import a policy package, a per-device mapping is usually added when the object is already used by a FortiGate.

Dynamic mapping examples

The following are a few example objects configured with dynamic mapping in the CLI:

Example 1: Dynamic VIP

config firewall vip

edit "vip1"

…

config dynamic_mapping

edit "FW60CA3911000089"-"root"

set extintf "any"

set extip 172.18.26.100

set mappedip 192.168.3.100

set arp-reply disable

next

end

end

Example 2: Dynamic Address

config firewall address

edit "address1"

…

config dynamic_mapping

edit "FW60CA3911000089"-"root"

set subnet 192.168.4.0 255.255.255.0

next

end

end

Example 3: Dynamic Interface

config dynamic interface

edit "1a1"

set default-mapping enable

set defmap-intf "1a1"

config dynamic_mapping

edit "1"-"root"

set local-intf "a"

next

end

config platform_mapping

edit "FortiGate-40F"

set intf-zone "ddd"

next

end

next

end