Create a new central SNAT policy

Central SNAT (source NAT) enables you to define and control (with more granularity) the address translation performed by the FortiGate unit. With the NAT table, you can define the rules which dictate the source address or address group and which IP pool the destination address uses.

While similar in functionality to IP pools, where a single address is translated to an alternate address from a range of IP addresses, with IP pools there is no control over the translated port. When using the IP pool for source NAT, you can define a fixed port to guarantee the source port number is unchanged. If no fixed port is defined, the port translation is randomly chosen by the FortiGate unit. With the central NAT table, you have full control over both the IP address and port translation.

The FortiGate unit reads the NAT rules in a top-down methodology, until it hits a matching rule for the incoming address. This enables you to create multiple NAT policies that dictate which IP pool is used based on the source address. The NAT policies can be rearranged within the policy list as well. NAT policies are applied to network traffic after a security policy.

If NGFW mode is policy-based, then it is assumed that central NAT (specifically SNAT) is enabled implicitly.

See Central SNAT in the FortiOS Administration Guide for more information about central SNAT.

Central SNAT does not support Section View.

Central NAT must be enabled when creating or editing the policy package for this option to be available in the tree menu. See Create new policy packages. Central SNAT must also be enabled in Feature Visibility for the option to be visible in the tree menu. On the Policy & Objects tab, from the Tools menu, select Feature Visibility. In the Policy section, select the Central SNAT check box to display this option.

To create a new central SNAT policy:

1. If using ADOMs, ensure that you are in the correct ADOM.
2. Go to Policy & Objects > Policy Packages.
3. In the tree menu for the policy package in which you will be creating the new policy, select Central SNAT Policy.
4. Click Create New.
5. Enter the following information:

   Option	Description
   Type	Select whether to perform SNAT on IPv4 or IPv6.
   Incoming Interface	Click the field then select interfaces. Click the remove icon to remove interfaces. New objects can be created by clicking the Create New icon in the Object Selector frame. See Creating objects for more information.
   Outgoing Interface	Select outgoing interfaces in the same manner as Incoming Interface.
   Source Address	Select source addresses, address groups, virtual IPs, and virtual IP groups.
   Destination Address	Select destination addresses, address groups, virtual IPs, and virtual IP groups.
   NAT	Select to enable NAT.If enabled, select NAT, NAT46, or NAT64. If Type is set to IPv4, NAT64 is not available. If Type is set to IPv6, NAT46 is not available.
   IP Pool Configuration	If NAT is selected, select Use Outgoing Interface Address or Use Dynamic IP Pool.
   Protocol	Select the protocol: ANY, TCP, UDP, SCTP, or Specify. If Specify is selected, specify the protocol number. This option is only available when NAT is selected.
   Explicit Port Mapping	Enable or disable port mapping, then set the Original Source Port to match. Choose an original source port from one to 65535. The NAT'd port will be chosen by the FortiGate based on the IP Pool configuration. Explicit port mapping cannot apply to some protocols which do not use ports, such as ICMP. When enabling a NAT policy which uses Explicit port mapping, always consider that ICMP traffic will not match this policy. When using IP Pools, only the Overload type IP Pool allows Explicit port mapping. When Explicit port mapping is applied, you must define an original source port range and a translated sort port range. The source port will map one to one with the translated port. See Dynamic SNAT in the FortiOS Administration Guide for more information about how each IP pool type works.
   Comments	Add a description of the policy, such as its purpose, or the changes that have been made to it.
   Advanced Options	Configure advanced options, see Advanced options below.For more information on advanced option, see the FortiOS CLI Reference.
   Change Note	Add a description of the changes being made to the policy. This field is required.

6. Click OK to create the policy. You can select to enable or disable the policy in the right-click menu. When disabled, a disabled icon will be displayed in the Seq.# column to the left of the number. By default, policies will be added to the bottom of the list, but above the implicit policy.

Advanced options

Option	Description	Default
uuid	Enter the universally unique identifier (UUID). This value is automatically assigned but can be manually reset.	00000000-0000- 0000-0000- 000000000000