How To Configure Nat In Fortigate Firewall

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

FortiGate can perform NAT in two different ways: policy NAT, where source NAT is enabled directly in an IPv4 firewall policy, and Central NAT, where source translation is handled by a separate Central SNAT table. Destination NAT, including port forwarding, uses VIP objects.

The correct configuration depends on whether Central NAT is enabled. The instructions below use the FortiOS 7.6.5 and 7.6.6 interface paths. Before changing NAT, confirm the current mode and take a configuration backup.

#	Preview	Product	Price
1		FortiGate-40F Firewall Appliance - 5 Gigabit Ethernet RJ45 Ports, Ideal for Small Businesses...	$371.44	Buy on Amazon
2		FortiGate-60F Firewall Appliance - 10 Gigabit Ethernet RJ45 Ports, Includes DMZ, WAN & Internal...	$504.70	Buy on Amazon
3		FortiGate-40F Firewall Appliance plus 1 Year FortiCare Premium and FortiGuard Unified Threat...	$840.45	Buy on Amazon
4		Fortinet FortiGate-30G Firewall for Small Offices with 4 Gigabit Ethernet RJ45 Ports (FG-30G)	$453.05	Buy on Amazon
5		FortiGate-60F Network Security Appliance Plus 1 Year FortiGuard Unified Threat Protection (UTP) and...	$1,008.87	Buy on Amazon

Understand FortiGate NAT modes first

Central NAT is disabled by default in standard policy-based configurations. However, in policy-based NGFW mode, central SNAT is assumed to be enabled implicitly. Do not mix instructions from the two modes.

The most common configuration error is enabling NAT in a firewall policy while Central NAT is active. In that situation, the policy NAT option is skipped. The source translation must be defined in config firewall central-snat-map.

#1 Best Overall

FortiGate-40F Firewall Appliance - 5 Gigabit Ethernet RJ45 Ports, Ideal for Small Businesses (Appliance Only, No Subscription) (FG-40F)

• Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
• Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
• High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
• Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
• Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.

$371.44

Buy on Amazon

Configure outbound NAT with a firewall policy

Use policy NAT when Central NAT is disabled and internal clients need to access the Internet through the FortiGate’s outgoing interface address or an IP pool.

Using the GUI

1. Go to Policy & Objects > Firewall Policy.
2. Edit the IPv4 policy that allows traffic from the internal interface to the WAN interface, or select Create New.
3. Set the incoming interface to the LAN or internal interface.
4. Set the outgoing interface to the WAN interface.
5. Choose the appropriate source address, destination address, schedule, and service.
6. Enable NAT.
7. For normal masquerading, select Use Outgoing Interface Address.
8. For a fixed public address or address range, select an IP pool instead.
9. Save the policy and place it above any broader policy that could match first.

The firewall policy must allow the traffic. NAT only changes the source address; it does not replace the security policy.

Policy NAT CLI example

config firewall policy
    edit 12
        set name "LAN-to-Internet"
        set srcintf "lan"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
end

The important command is set nat enable. The policy ID, interfaces, address objects, and services must match your own configuration.

Enable Central NAT

Central NAT moves source translation out of individual firewall policies and into a dedicated, ordered table.

Enable it in the GUI

1. Go to System > Settings.
2. Under System Operations Settings, enable Central SNAT.
3. Click Apply.

After it is enabled, Central SNAT appears under Policy & Objects.

Enable it with the CLI

config system settings
    set central-nat enable
end

To turn it off:

config system settings
    set central-nat disable
end

Before switching modes, check whether any VIP is attached to a firewall policy. A VIP assigned to a policy in non-central mode must be unassigned before switching to Central NAT. The VIP object itself can remain available.

Configure outbound Central SNAT

Using the GUI

1. Go to Policy & Objects > Central SNAT.
2. Click Create New.
3. Set the incoming interface to the internal interface.
4. Set the outgoing interface to the WAN interface.
5. Choose the source and destination address objects.
6. Enable NAT.
7. Under IP Pool Configuration, choose Use outgoing interface address for masquerading, or Use Dynamic IP Pool for a configured pool.
8. Optionally restrict the rule by protocol, destination port, or source port.
9. Enable the policy and save it.

Central SNAT rules are evaluated from top to bottom. FortiGate stops at the first matching rule, so put specific rules above general rules. For example, a rule for one server or destination port should be above a rule matching all internal addresses and all services.

Rank #2

Sale

FortiGate-60F Firewall Appliance - 10 Gigabit Ethernet RJ45 Ports, Includes DMZ, WAN & Internal Ports (Appliance Only, No Subscription) (FG-60F)

• Extensive Connectivity Options: The FortiGate 60F is designed with 10 GE RJ45 ports, including 2 WAN ports, 1 DMZ port, and 7 internal ports, offering broad flexibility and high-density connections for diverse enterprise networking needs.
• Superior Performance for Secure Networks: Features powerful system-on-a-chip acceleration to deliver top-tier security with 1.4 Gbps IPS throughput and 700 Mbps threat protection throughput, ensuring effective defense against advanced threats.
• Enhanced SSL Inspection and SD-WAN Capabilities: Utilizes purpose-built security processor technology to provide the industry's highest SSL inspection performance and robust SD-WAN functionality for secure, high-speed network operations.
• Simple and Effective Management: Comes equipped with a user-friendly management console that supports comprehensive network automation and visibility, alongside Zero Touch Integration with Fortinet's Security Fabric for streamlined deployment.
• Advanced Security Features: Leverages continuous threat intelligence from AI-powered FortiGuard Labs, identifying and mitigating both known and unknown threats, enhancing security across all network traffic, whether encrypted or not.

$504.70

Buy on Amazon

Central SNAT is applied after the security policy. A matching SNAT rule cannot make a denied session work.

Central SNAT CLI example

config firewall central-snat-map
    edit 1
        set status enable
        set srcintf "lan"
        set dstintf "wan1"
        set orig-addr "LAN-subnets"
        set dst-addr "all"
        set nat enable
    next
end

A more selective rule can include a protocol and destination port:

config firewall central-snat-map
    edit 2
        set status enable
        set srcintf "lan"
        set dstintf "wan1"
        set orig-addr "app-server"
        set dst-addr "all"
        set protocol 6
        set dst-port 443
        set nat enable
        set comments "HTTPS outbound translation"
    next
end

Protocol number 6 represents TCP. Use the address objects and interface names that exist on your FortiGate.

Configure a dynamic IP pool

Use an IP pool when outbound sessions must use a particular public address or range instead of the WAN interface address.

1. Go to Policy & Objects > IP Pools.
2. Click Create New.
3. Enter the external IP address or range.
4. Choose the appropriate pool type and save it.
5. Select the pool in the policy NAT configuration or in the Central SNAT rule.

Explicit port mapping is supported only with an Overload IP pool. It is not available with every pool type.

Configure destination NAT and port forwarding

Destination NAT forwards an external address to an internal server. FortiGate implements this with a VIP, or virtual IP object.

Supported VIP types include static VIPs, static VIPs with services, static VIPs with port forwarding, FQDN-based VIPs, and virtual-server load balancing.

Rank #3

FortiGate-40F Firewall Appliance plus 1 Year FortiCare Premium and FortiGuard Unified Threat Protection (UTP) (FG-40F-BDL-950-12)

• INTEGRATED FIREWALL APPLIANCE AND SECURITY SERVICES: Comes with FortiGate-40F Firewall Appliance, 1 year of FortiCare Premium, and FortiGuard Unified Threat Protection.
• UTP SECURITY FEATURES: Offers protection from advanced threats with DNS filtering, URL filtering, video filtering, and controls against botnets.
• IDEAL FOR SMALLER SETTINGS: Best suited for small to mid-sized businesses needing reliable security without the complexity of larger systems.
• CONTINUOUS SUPPORT AND MAINTENANCE: FortiCare Premium ensures that technical help is readily available to manage and troubleshoot issues.
• COMPACT AND EFFECTIVE: Provides a powerful, yet compact security solution that effectively protects against a wide range of cyber threats.

$840.45

Buy on Amazon

Central NAT mode: create a VIP

1. Go to Policy & Objects > DNAT & Virtual IPs.
2. On the Virtual IP tab, click Create New.
3. Enter a name.
4. Set the external IP address or range.
5. Set Map to IPv4 address/range to the internal server address.
6. Enable the VIP.
7. For port forwarding, select the external service or port and specify the mapped internal port.
8. Save the object.

A basic static VIP can be created with the CLI:

config firewall vip
    edit "public-web-server"
        set extip 203.0.113.50
        set mappedip "10.10.20.50"
        set extintf "wan1"
        set status enable
    next
end

Use a documentation or lab address such as 203.0.113.50 only as an example. Replace it with the public address assigned to your deployment.

Create the DNAT firewall policy

The VIP alone does not permit traffic. Create an IPv4 firewall policy from the WAN interface to the internal server or server interface.

1. Go to Policy & Objects > Firewall Policy.
2. Click Create New.
3. Set the incoming interface to the WAN interface.
4. Set the outgoing interface to the server interface.
5. Use all or a restricted source address object as appropriate.
6. Set the destination to the internal server address object used by the VIP.
7. Set the schedule to always.
8. Choose only the required service, such as HTTPS rather than ALL.
9. Set the action to ACCEPT.
10. Save the policy and place it in the correct order.

In Central NAT mode, this DNAT policy does not use the normal policy NAT section. The enabled VIP performs destination translation, while Central SNAT rules handle source translation where required.

Non-central NAT mode

When Central NAT is disabled, the VIP is selected in the firewall policy’s destination or NAT configuration, depending on the FortiOS interface and policy type. The policy then both permits the inbound traffic and references the VIP.

Configure IPv6 Central SNAT

IPv4 and IPv6 Central SNAT maps appear in the same Central SNAT table, but IPv6 must be enabled for the VDOM and the rule must be created as an IPv6 policy.

1. In the Global VDOM, go to System > VDOM.
2. Select the target VDOM and click Edit.
3. Enable Central SNAT in the virtual domain settings.
4. Click OK.
5. Enter the target VDOM.
6. Go to Policy & Objects > Central SNAT and click Create New.
7. Set Type to IPv6.
8. Configure the IPv6 interfaces, address objects, and IP pool.

Example:

config vdom
    edit FG-traffic
        config system settings
            set central-nat enable
        end
    next
end

config vdom
    edit FG-traffic
        config firewall central-snat-map
            edit 2
                set type ipv6
                set srcintf "wan2"
                set dstintf "wan1"
                set orig-addr6 "all"
                set dst-addr6 "all"
                set nat-ippool6 "test-ippool6-1"
            next
        end
    next
end

Control source-port preservation

FortiGate enables source-port preservation by default. When the original port is available, FortiGate attempts to retain it. If preservation is disabled, it changes the source port to the next available port.

Automatic preservation applies only to source ports from 5117 through 65533. Ports below 5117 are translated to a port above 5117 unless explicit port mapping is configured.

Rank #4

Fortinet FortiGate-30G Firewall for Small Offices with 4 Gigabit Ethernet RJ45 Ports (FG-30G)

• Single appliance with integrated firewalling, SD-WAN and Wi-Fi controller reduces complexity of WLAN management. Its zero-touch deployment helps optimize your onboarding experience.
• Built on a patented secure processor, this compact network firewall delivers the highest level of security and performance in its class – 800 Mbps IPS | 500 Mbps threat protection.
• User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
• Compact and fanless design equipped with 4 GE RJ45 ports (1 WAN port and 3 internal ports) provide essential connectivity and flexibility for various network configurations in a small-scale environment.
• Fortinet is the most deployed and trusted firewall from businesses worldwide with 99.98% security effectiveness, surpassing competition. Fortinet is the only vendor recognized as a firewall leader 13 consecutive years by Gartner.

$453.05

Buy on Amazon

For a Central SNAT rule:

config firewall central-snat-map
    edit 1
        set port-preserve enable
    next
end

For policy NAT:

config firewall policy
    edit 12
        set nat enable
        set port-preserve enable
    next
end

ICMP has no source or destination ports. Therefore, a rule requiring explicit port mapping cannot match ICMP traffic.

Hairpin NAT

Hairpin NAT is needed when an internal client connects to an internal server by using the server’s public address or VIP. The FortiGate must translate the destination to the internal server and usually translate the source as well, so the server sends its reply back through the FortiGate.

Create both:

• A DNAT policy referencing the VIP.
• An SNAT policy that translates the internal client’s source address.

In non-central mode, configure the VIP under Policy & Objects > Virtual IPs. With Central NAT enabled, use Policy & Objects > DNAT & Virtual IPs and configure the source translation in Central SNAT.

Verify and troubleshoot NAT

1. Confirm the NAT mode. Check System > Settings or inspect config system settings.
2. Check the security policy. A policy must accept the session before Central SNAT can be applied.
3. Check rule order. A broad Central SNAT rule above a specific rule will capture the traffic first.
4. Check interfaces and address objects. An incorrect incoming interface, outgoing interface, source, or destination prevents a match.
5. Check the VIP status. A disabled VIP is not active and cannot perform DNAT.
6. Check the service and ports. Port-forwarding rules must use the correct external and mapped ports.
7. Clear old sessions. NAT changes do not alter an existing session. Clear the old session and generate new traffic before testing again.

If outbound traffic works with policy NAT but stops after Central NAT is enabled, remove the assumption that the firewall policy’s NAT checkbox is still active. Create a matching entry in Policy & Objects > Central SNAT instead.

FAQ

Should NAT be enabled in the firewall policy when Central NAT is enabled?

No. With Central NAT enabled, the policy NAT option is skipped for source translation. Configure SNAT in Policy & Objects > Central SNAT or in config firewall central-snat-map.

Does Central SNAT run before the firewall policy?

No. Fortinet documents Central SNAT as being applied after the security policy. A denied session is not rescued by a matching SNAT rule.

Why is my Central SNAT rule not matching?

Check the rule order, interfaces, source and destination objects, protocol, ports, enabled status, and the security policy. Central SNAT evaluates rules top down and uses the first match.

Best Value

FortiGate-60F Network Security Appliance Plus 1 Year FortiGuard Unified Threat Protection (UTP) and FortiCare Premium (FG-60F-BDL-950-12)

• HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
• UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
• OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
• RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
• EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.

$1,008.87

Buy on Amazon

Do I need to enable NAT in a policy for port forwarding?

In Central NAT mode, no. Create and enable a VIP, then create a firewall policy that allows traffic to the VIP’s translated internal destination. Source NAT, if needed, is configured separately in Central SNAT.

Why does my VIP not forward traffic?

Confirm that the VIP is enabled, its external address and mapped address are correct, the external interface is correct, and an inbound firewall policy allows the required service to the translated server.

Can source-port preservation preserve every original port?

No. Automatic preservation applies to ports 5117 through 65533. Lower ports require explicit port mapping. Explicit port mapping also requires an Overload IP pool and cannot be used for ICMP.

Why did traffic continue using the old NAT address after I changed the configuration?

Existing sessions retain their original translation. Clear the existing session and create a new connection before verifying the change.

How do I configure IPv6 Central SNAT?

Enable Central SNAT for the target VDOM, open Policy & Objects > Central SNAT, create a rule, and set Type to IPv6. IPv4 and IPv6 maps appear in the same table.

The Bottom Line

For ordinary outbound translation, use policy NAT when Central NAT is disabled: edit the IPv4 firewall policy and enable NAT. For Central NAT deployments, leave the policy NAT option out of the design and create an ordered rule under Policy & Objects > Central SNAT. For inbound publishing and port forwarding, create an enabled VIP and an allowing firewall policy. Finally, clear old sessions whenever you change NAT so the test uses the new translation.

Quick Recap

Bestseller No. 1

FortiGate-40F Firewall Appliance - 5 Gigabit Ethernet RJ45 Ports, Ideal for Small Businesses (Appliance Only, No Subscription) (FG-40F)

$371.44

SaleBestseller No. 2

FortiGate-60F Firewall Appliance - 10 Gigabit Ethernet RJ45 Ports, Includes DMZ, WAN & Internal Ports (Appliance Only, No Subscription) (FG-60F)

$504.70

Bestseller No. 3

FortiGate-40F Firewall Appliance plus 1 Year FortiCare Premium and FortiGuard Unified Threat Protection (UTP) (FG-40F-BDL-950-12)

$840.45

Bestseller No. 4

Fortinet FortiGate-30G Firewall for Small Offices with 4 Gigabit Ethernet RJ45 Ports (FG-30G)

$453.05

Bestseller No. 5

FortiGate-60F Network Security Appliance Plus 1 Year FortiGuard Unified Threat Protection (UTP) and FortiCare Premium (FG-60F-BDL-950-12)

$1,008.87

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.