2.3 Destination NAT (DNAT), Virtual IPs (VIPs) & Central NAT

2.3 Destination NAT (DNAT), Virtual IPs (VIPs) & Central NAT

Destination Network Address Translation (DNAT) allows external users on public networks to access servers residing on internal private networks (such as DMZs or internal LANs) without exposing private IP structures. In FortiOS 7.6, DNAT is primarily implemented using Virtual IPs (VIPs). Understanding VIP types, port forwarding, policy integration, and the transition to Central NAT is essential for passing the FCP FortiGate Administrator exam.

---

1. Destination NAT Architecture & Virtual IPs (VIPs)

DNAT intercept incoming packets arriving on an external interface, inspects their destination IP address (and port), and replaces the destination IP with the private IP address of an internal real server.

[ External Client: 198.51.100.5 ] ---> ( Ingress port1: 203.0.113.50:8443 )
                                             |
                                  [ FortiGate VIP Matching ]
                                  ( DNAT: 203.0.113.50:8443 -> 192.168.10.100:443 )
                                             |
[ Web Server: 192.168.10.100:443 ] <--- ( Egress port2: LAN/DMZ )

Virtual IP (VIP) Object Types

In FortiOS, DNAT constructs are created under config firewall vip. FortiGate supports four primary VIP deployment models:

1. Static NAT (1:1 DNAT): Maps an external IP address (extip) directly to an internal IP address (mappedip) across all ports. Incoming traffic targeted to any port on extip is forwarded to the corresponding port on mappedip.
2. Port Forwarding (PAT / DNAT with Port Translation): Maps an external IP address and specific external port (extport) to an internal IP address and internal port (mappedport).
   • Example: External users connect to 203.0.113.50:8443. FortiGate translates the destination to 192.168.10.100:443 (internal HTTPS).
3. Server Load Balancing (SLB) VIPs: Distributes incoming traffic across a farm of real servers (config firewall vip -> set type server-load-balance). Includes integrated health checks (HTTP, HTTPS, Ping, TCP) and balancing algorithms (Round Robin, Weighted, Least Connections).
4. VIP Groups (config firewall vipgrp): Combines multiple VIP objects into a single group object. Allows administrators to bind multiple published services to a single firewall policy.

---

2. Policy-Based DNAT vs. Central NAT

FortiOS supports two architectural modes for handling address translation: Policy-Based NAT (the default mode) and Central NAT.

Policy-Based DNAT Workflow

When using default Policy-Based NAT:

1. Create the VIP object under config firewall vip specifying extip, mappedip, and optional port forwarding.
2. Create a firewall policy where:
   • srcintf: Ingress interface (e.g., port1 / WAN).
   • dstintf: Egress interface connected to real server (e.g., port2 / DMZ).
   • srcaddr: all (or restricted external sources).
   • dstaddr: Must be the VIP Object Name (NOT the real internal IP).
   • service: Matches the external service port (e.g., HTTP/HTTPS).

During packet processing, FortiGate performs destination address translation before checking the policy table so that the policy engine can evaluate the incoming packet against the VIP object specified in dstaddr.

---

3. Central NAT Architecture & Operation

In complex enterprise environments, coupling NAT rules directly inside security policies can create administrative friction. Central NAT cleanly separates security policy enforcement from NAT policy rules.

Enabling Central NAT

Central NAT is enabled per-VDOM via the CLI:

config system settings
    set central-nat enable
end

WARNING: Enabling Central NAT hides the standard NAT toggles inside config firewall policy. Existing policy-based NAT rules are converted or require Central SNAT map definitions.

Central SNAT Map (config firewall central-snat-map)

Source NAT policies are defined independently in the Central SNAT map. Each entry specifies source/destination interfaces, original source/destination addresses, and the desired IP Pool or interface NAT behavior:

config firewall central-snat-map
    edit 1
        set srcintf "port2"
        set dstintf "port1"
        set orig-addr "Corp_LAN_Subnet"
        set dst-addr "all"
        set nat-ippool "Sales_Overload_Pool"
    next
end

---

4. CLI Configuration & Diagnostic Workflows

1. Creating a Port Forwarding VIP Object

config firewall vip
    edit "Web_Server_8443_VIP"
        set extip 203.0.113.50
        set extintf "port1"
        set portforward enable
        set mappedip "192.168.10.100"
        set extport 8443
        set mappedport 443
        set protocol tcp
    next
end

2. Binding VIP to a Policy (Policy-Based NAT)

config firewall policy
    edit 20
        set name "Publish_Web_Server"
        set srcintf "port1"
        set dstintf "port2"
        set srcaddr "all"
        set dstaddr "Web_Server_8443_VIP"
        set action accept
        set schedule "always"
        set service "HTTPS"
        set utm-status enable
        set av-profile "default"
    next
end

3. Diagnostics & Debug Commands

• List Active Virtual IPs & Match Statistics: diagnose firewall vip list
• Inspect Session Table for DNAT Verification: diagnose sys session filter dst 203.0.113.50 diagnose sys session list
• Check ARP Entries for VIP External IPs: diagnose ip arp list