# NAT: SNAT hides you, VIP publishes them Source: https://ai.techclick.in/blog_fortigate_snat_vip_dnat Markdown: https://ai.techclick.in/blog_fortigate_snat_vip_dnat.md Publisher: Techclick Infosec Pvt Ltd Hide outbound with IP pool / use-outgoing. Publish inbound with a VIP. Dummy WAN 203.0.113.10, server 10.20.30.40. ## The ticket pay-api is 10.20.30.40. Users from the internet get connection timeout. Outbound NAT works. Junior put the VIP in the source of a LAN-to-WAN rule. Quick interview answer SNAT (source NAT) rewrites the inside source — policy NAT toggle or IP pool, or Central SNAT table if enabled. VIP is destination NAT: external 203.0.113.10:443 → 10.20.30.40:443. FortiOS then matches a firewall policy whose destination is that VIP (or the mapped address depending on mode). Policy first, then the VIP that policy references — not “most specific VIP wins the packet.” Hero · two arrows Outbound hide vs inbound publish. Opposite directions. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model SNAT VIP (DNAT) Rewrites Source Destination (and optional port) Typical policy LAN → WAN ACCEPT + NAT WAN → LAN dest=VIP ACCEPT This lab 10.20.30.80 → 203.0.113.10 203.0.113.10:443 → 10.20.30.40:443 https://fgt-hq.techclick-lab.in Training mock · not live Admin Dashboard Policy VPN Network Policy & Objects → Virtual IPs ### VIP pay-api-443 Name pay-api-443 External IP address/range 203.0.113.10 Map to IPv4 address 10.20.30.40 Port Forwarding 443 → 443 Firewall policy dest pay-api-443 (WAN → LAN) Cancel Save FortiOS 7.4 Virtual IPs. Training mock. ## How to choose Need Object Many inside hosts, one public SNAT use outgoing / overload pool One public to one server VIP + WAN-to-LAN policy Many publics IP pool (outbound) or one VIP each (inbound) Central SNAT on Separate SNAT policy table — VIP still for inbound ## Runbook - #### Side A — VIP Create pay-api-443. Do not skip port-forward if 443 is already used for admin — this lab admin is on 10.10.10.1, not WAN 443. - #### Side B — policy WAN → LAN, dest VIP, service HTTPS, log, no SNAT required inbound. - #### Side C — prove diagnose sys session filter dst 10.20.30.40 then diagnose sys session list . See hook= and proto=6. Session proof diagnose sys session filter clear diagnose sys session filter dport 443 diagnose sys session list # original: 198.51.100.80:54321 -> 203.0.113.10:443 # reply: 10.20.30.40:443 -> 198.51.100.80:54321 # policy_id: 20 ## Four failures ### 1 · VIP without WAN-to-LAN policy DNAT happens, implicit deny eats it. Always pair them. ### 2 · VIP in the source field Wrong direction. VIP is a destination object for inbound. ### 3 · Hairpin / NAT reflection LAN users hitting the public IP. Enable nat-source-vip / hairpin as designed — or use internal DNS. ### 4 · Central SNAT surprise Enabling Central SNAT moves outbound NAT out of the firewall policy checkbox. Inbound VIP still needs its policy. ## How to prove it Close only when 1) Session shows original public dest and reply from 10.20.30.40. 2) policy_id is the WAN-to-LAN rule. 3) You did not NAT the inbound source by accident unless you meant to. ## Traps Symptom Look at SYN to public, no SYN-ACK VIP map + server default gateway = FGT + policy Outbound some apps fail IP pool exhaustion / sticky ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 A VIP is primarily… Source NAT Destination NAT to publish a server A zone An SD-WAN rule Correct: b . Concept. Q2 Inbound HTTPS needs… Only SNAT VIP + WAN-to-LAN policy using that VIP LAN-to-WAN any-any FortiManager ADOM Correct: b . Runbook. Q3 Priya browsing internet uses… VIP SNAT / outgoing interface IP or IP pool DNAT port 80 on WAN Implicit deny Correct: b . Outbound hide. Q4 Junior put the VIP in the source of a LAN-to-WAN rule. Why is that wrong? VIP is the inbound destination object VIP disables logging VIP is only IPv6 VIP replaces zones Correct: a . Ticket. Q5 Central SNAT changes… Where outbound SNAT is configured That VIPs stop existing That first match is off HA mode Correct: a . Failure 4. Q6 Session list original dest 203.0.113.10:443 reply from 10.20.30.40 proves… Only SNAT DNAT/VIP is hitting the real server Policy 3 shadowed it FMG install Correct: b . Proof. Check answers Reset FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview ## Sources - FortiOS 7.4 — Static virtual IPs . - FortiOS 7.4 — Dynamic SNAT / IP pools / Central SNAT . Related: FortiGate session factory · VPN series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt