2.2 Source Network Address Translation (SNAT) & IP Pools

2.2 Source Network Address Translation (SNAT) & IP Pools

Source Network Address Translation (SNAT) is a foundational capability of FortiGate firewalls, allowing private interior networks (RFC 1918) to communicate across public networks such as the Internet. On the Fortinet FCP - FortiGate 7.6 Administrator exam, candidates are tested extensively on SNAT operational modes, IP Pool types, port allocation behaviors, and pool exhaustion troubleshooting.

---

1. Source NAT Fundamentals & Egress Interface NAT

SNAT modifies the source IP address (and optionally the source port) of a packet as it exits the FortiGate firewall. SNAT is configured directly within a firewall policy (set nat enable) or governed by Central SNAT rules.

Egress Interface SNAT (Default Mode)

When NAT is enabled on a firewall policy without specifying an IP Pool (set ippool disable), FortiGate performs Outgoing Interface IP SNAT:

• The original private source IP (e.g., 192.168.1.50) is replaced with the primary IP address configured on the outgoing (egress) interface (e.g., 203.0.113.1).
• Source ports are dynamically translated (Port Address Translation / PAT) to prevent port collisions among multiple internal hosts.

[ Host: 192.168.1.50:49152 ] ---> ( Ingress port2 )
                                       |
                             [ Firewall Policy: NAT Enabled ]
                                       |
[ Host: 203.0.113.1:10024 ]  <--- ( Egress port1: 203.0.113.1 )

While interface NAT is ideal for small branch offices with a single dynamic or static public IP, enterprise environments requiring granular public IP representation rely on IP Pools.

---

2. FortiOS IP Pool Types & Translation Mechanics

FortiOS 7.6 provides four distinct IP Pool types (config firewall ippool), each tailored for specific networking, scaling, and compliance requirements:

1. Overload IP Pools

• Mechanism: Overload pools utilize Port Address Translation (PAT). FortiGate assigns an available IP from the defined pool range and maps host connections using available ephemeral source ports (typically ports 1024 to 65535, giving ~60,416 sessions per IP address).
• IP Allocation Logic: If the pool contains multiple IP addresses (e.g., 203.0.113.10 to 203.0.113.12), FortiGate distributes host sessions across pool IPs using round-robin or hash-based algorithms (set type overload).
• Exhaustion Handling: If all ephemeral ports across all pool IPs are consumed for a given protocol, subsequent new connection attempts are dropped.

2. One-to-One IP Pools

• Mechanism: One-to-One pools dynamically assign an entire external IP address from the pool to a single internal source IP (set type one-to-one). No source port translation takes place.
• Mapping Lifetime: The mapping between the internal host IP and external pool IP persists as long as active sessions exist for that host.
• Exhaustion Handling: Once all public IP addresses in the pool are assigned to active internal hosts, any additional internal hosts attempting to initiate connections are blocked and dropped until an existing host's mapping expires.

3. Fixed Port Range IP Pools

• Mechanism: Fixed Port Range (set type fixed-port-range) disables source port translation. An internal host's source port (e.g., TCP 5000) is preserved exactly as TCP 5000 on the external pool IP address.
• Constraint: Only one internal host can use a given source port on a single pool IP simultaneously. If two internal hosts attempt to use source port 5000 concurrently, the second host is assigned a different IP from the pool (if available) or dropped.

4. Port Block Allocation (PBA)

• Mechanism: Designed to solve compliance and logging scalability challenges in large enterprise networks. Instead of logging every single NAT session creation/deletion, FortiGate allocates a fixed block of consecutive external ports (e.g., 128 or 256 ports) to an internal IP upon its first session (set type port-block-allocation).
• Benefits:
  • Drastic Log Reduction: FortiGate generates a single log entry when a block is assigned to a host and another when released, rather than logging millions of individual TCP sessions.
  • Deterministic NAT Tracing: Law enforcement or security auditing can easily map an external port range back to an internal host IP based on static block ranges.

---

3. ARP Reply & IP Pool Routing Considerations

When an IP pool uses IP addresses that differ from the primary IP of the FortiGate egress interface, incoming traffic targeted to those pool IPs (e.g., return traffic from external servers or ARP requests from upstream routers) must reach the FortiGate.

• ARP Reply Feature (set arp-reply enable): Enabled by default on IP pools. FortiGate automatically responds to ARP requests on the egress interface for any IP address defined within an active IP pool.
• Upstream Routing: Upstream routers must have a route pointing the IP pool subnet to the FortiGate egress interface.

---

4. CLI Configuration & Diagnostic Commands

Configuring IP Pools in CLI

# 1. Overload Pool Configuration
config firewall ippool
    edit "Sales_Overload_Pool"
        set type overload
        set startip 203.0.113.10
        set endip 203.0.113.12
        set arp-reply enable
    next
# 2. Port Block Allocation Pool Configuration
    edit "CGNAT_PBA_Pool"
        set type port-block-allocation
        set startip 198.51.100.20
        set endip 198.51.100.25
        set block-size 128
        set num-blocks-per-user 4
    next
end

# Binding IP Pool inside a Firewall Policy
config firewall policy
    edit 15
        set name "Outbound_Sales_NAT"
        set srcintf "port2"
        set dstintf "port1"
        set srcaddr "Sales_IP_Range"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
        set ippool enable
        set poolname "Sales_Overload_Pool"
    next
end

Troubleshooting & Monitoring SNAT & IP Pools

• View Active IP Pool Summary & Allocation Status: diagnose firewall ippool list
• Filter Session Table for SNAT Debugging: diagnose sys session filter src 192.168.10.50 diagnose sys session list
• Inspect NAT Translation Table: diagnose firewall iprope list