Transparent and NAT/route modes

A FortiProxy unit can operate in either NAT/route mode or transparent mode.

In NAT/route mode, a FortiProxy unit is installed as a gateway or router between multiple networks, such as a private network and the internet. One function of NAT/route mode is to allow the FortiProxy to hide the IP addresses on the private network using NAT.

The FortiProxy operates in layer 2 to forward traffic between network devices such as routers, firewalls, and switches. For example. it can be installed inline between a router and a switch to perform security scanning without changing the network topology or modifying the IP addresses.

Transparent mode is used primarily when there is a need to increase network protection but changing the configuration of the network itself is impractical. When you add a FortiProxy that is in transparent mode to a network, it only needs to be provided with a management IP address in order to access the device. It is recommended to configure a dedicated management interface when out-of-band management is required in transparent mode. See Transparent mode management.

Changing the operation mode removes most configurations, including any policies and address objects. To keep your configuration, back it up before changing the mode. To back up your configuration in the GUI: Click on the user name and select Configuration > Backup. Select where to store the backup file, Local PC or USB Disk (if available). Optionally, enable Encryption and enter a password. Click OK. To back up your configuration in the CLI: # execute backup {config | full-config} {flash | ftp | management-station | sftp | tftp | usb | usb-mode} ...

To change from NAT/route mode to transparent mode:

config system settings
    set opmode transparent     
    set manageip <IP_address>
    set gateway <gateway_address> 
end

The gateway setting is optional, but after the operation mode has been changed, the gateway configuration is in the static router settings:

config router static
    edit <seq-num>
        set gateway <IP_address>
    next
end

To change from transparent mode to NAT/route mode:

config system settings
    set opmode nat
    set ip <IP_address>
    set device <interface>
    set gateway <gateway_address>     
end

The IP and device settings are mandatory, and the gateway setting is optional. After the operation mode is changed, the IP address configuration is in the interface settings and the gateway and device configurations are in the static router settings:

config system interface
    edit <interface>
        set ip <IP_address>
    next
end

config router static
    edit <seq-num>
        set gateway <IP_address>
        device <interface>
    next
end