config firewall vip
Use this command to configure 1-to-1 NAT rules.
You can use 1-to-1 NAT when you want to publish public or “external” IP addresses for FortiADC resources but want the communication among servers on the internal network to be on a private or “internal” IP address range.
1-to-1 NAT is supported for traffic to virtual servers. The address translation occurs before the ADC has processed its rules, so FortiADC server load balancing policies that match source address (such as content routing and content rewriting rules) should be based on the mapped address space.
The system maintains this NAT table and performs the inverse mapping when it sends traffic from the internal side to the external side.
Before you begin:
• You must have read-write permission for firewall settings.
Syntax
config firewall vip
edit <name>
set extif <datasource>
set extip <class_ip>
set extport <integer>
set mappedip-min <class_ip>
set mappedip-max <class_ip>
set mappedport-min <integer>
set mappedport-max <integer>
set portforward {enable | disable}
set protocol {tcp | udp}
next
end
extif | Interface that receives traffic. |
extip | Specify the first address in the range. The last address is calculated after you enter the mapped IP range. |
extport | Specify the first port number in the range. The last port number is calculated after you enter the mapped port range. |
mappedip-min | First address in the range. |
mappedip-max | Last address in the range. |
mappedport-min | First port in the range. |
mappedport-max | Last port in the range. |
portforward | Enable/disable port forwarding. |
protocol | • TCP • UDP |
Example
FortiADC-VM # config firewall vip
FortiADC-VM (vip) # edit 1-to-1-NAT
Add new entry '1-to-1-NAT' for node 661
FortiADC-VM (1-to-1-NAT) # get
extif :
extip : 0.0.0.0
mappedip-min : 0.0.0.0
mappedip-max : 0.0.0.0
portforward : disable
FortiADC-VM (1-to-1-NAT) # set extif port4
FortiADC-VM (1-to-1-NAT) # set extip 198.51.100.10
FortiADC-VM (1-to-1-NAT) # set mappedip-min 192.0.2.10
FortiADC-VM (1-to-1-NAT) # set mappedip-max 192.0.2.19
FortiADC-VM (1-to-1-NAT) # get
extif : port4
extip : 198.51.100.10
mappedip-min : 192.0.2.10
mappedip-max : 192.0.2.19
portforward : disable
FortiADC-VM (1-to-1-NAT) # end