Fortinet · FortiOS 7.4 · Lesson 4 of 12

NAT: SNAT hides you, VIP publishes them

Two different jobs. Outbound users need SNAT so the internet replies to 203.0.113.10. Inbound HTTPS to the pay-api VM needs a VIP (DNAT) plus a WAN-to-LAN policy that uses that VIP as destination. Mixing them is the classic “VIP in the source field” ticket.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Choose IP pool vs use outgoing interface IP.
Build a VIP and the WAN-to-LAN policy that references it.
Explain what Central SNAT changes in the GUI.
Prove with session list: original vs translated.

The ticket

pay-api is 10.20.30.40. Users from the internet get connection timeout. Outbound NAT works. Junior put the VIP in the source of a LAN-to-WAN rule.

Quick interview answer

SNAT (source NAT) rewrites the inside source — policy NAT toggle or IP pool, or Central SNAT table if enabled. VIP is destination NAT: external 203.0.113.10:443 → 10.20.30.40:443. FortiOS then matches a firewall policy whose destination is that VIP (or the mapped address depending on mode). Policy first, then the VIP that policy references — not “most specific VIP wins the packet.”

Outbound SNAT versus inbound VIP DNAT — Outbound hide vs inbound publish. Opposite directions.

Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

	SNAT	VIP (DNAT)
Rewrites	Source	Destination (and optional port)
Typical policy	LAN → WAN ACCEPT + NAT	WAN → LAN dest=VIP ACCEPT
This lab	10.20.30.80 → 203.0.113.10	203.0.113.10:443 → 10.20.30.40:443

https://fgt-hq.techclick-lab.in

Training mock · not live

Admin

DashboardPolicyVPNNetwork

Policy & Objects → Virtual IPs

VIP pay-api-443

Name

pay-api-443

External IP address/range

203.0.113.10

Map to IPv4 address

10.20.30.40

Port Forwarding

443 → 443

Firewall policy dest

pay-api-443 (WAN → LAN)

FortiOS 7.4 Virtual IPs. Training mock.

How to choose

Need	Object
Many inside hosts, one public	SNAT use outgoing / overload pool
One public to one server	VIP + WAN-to-LAN policy
Many publics	IP pool (outbound) or one VIP each (inbound)
Central SNAT on	Separate SNAT policy table — VIP still for inbound

Runbook

Side A — VIP
Create pay-api-443. Do not skip port-forward if 443 is already used for admin — this lab admin is on 10.10.10.1, not WAN 443.
Side B — policy
WAN → LAN, dest VIP, service HTTPS, log, no SNAT required inbound.
Side C — prove
diagnose sys session filter dst 10.20.30.40 then diagnose sys session list. See hook= and proto=6.

Session proof

diagnose sys session filter clear
diagnose sys session filter dport 443
diagnose sys session list
# original: 198.51.100.80:54321 -> 203.0.113.10:443
# reply:    10.20.30.40:443 -> 198.51.100.80:54321
# policy_id: 20

Four failures

1 · VIP without WAN-to-LAN policy

DNAT happens, implicit deny eats it. Always pair them.

2 · VIP in the source field

Wrong direction. VIP is a destination object for inbound.

3 · Hairpin / NAT reflection

LAN users hitting the public IP. Enable nat-source-vip / hairpin as designed — or use internal DNS.

4 · Central SNAT surprise

Enabling Central SNAT moves outbound NAT out of the firewall policy checkbox. Inbound VIP still needs its policy.

How to prove it

Close only when

1) Session shows original public dest and reply from 10.20.30.40. 2) policy_id is the WAN-to-LAN rule. 3) You did not NAT the inbound source by accident unless you meant to.

Traps

Symptom	Look at
SYN to public, no SYN-ACK	VIP map + server default gateway = FGT + policy
Outbound some apps fail	IP pool exhaustion / sticky

FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview