Firewall Virtual IP Configuring virtual IPs
FortiGate Version 3.0 MR4 Administration Guide
01-30004-0203-20070102 263
To add static NAT virtual IP port forwarding for an IP address range and a
port range to a firewall policy
Add a external to dmz1 firewall policy that uses the virtual IP so that when users
on the Internet attempt to connect to the web server IP addresses, packets pass
through the FortiGate unit from the external interface to the dmz1 interface. The
virtual IP translates the destination addresses and ports of these packets from the
external IP to the dmz network IP addresses of the web servers.
1 Go to Firewall > Policy and select Create New.
2 Configure the firewall policy:
3 Select NAT.
4 Select OK.
Adding a load balance virtual IP for an IP address range or real servers
The IP address 192.168.37.4 on the Internet is mapped to 10.10.123.42 through
10.10.123.44 on a private network. The IP address mapping is determined by the
FortiGate unit’s load balancing algorithm. Attempts to communicate with
192.168.37.4 from the Internet are translated and sent to 10.10.10.42,
10.10.10.10.43, or 10.10.10.44 by the FortiGate unit. The computers on the
Internet are unaware of this translation and see a single computer at 192.168.37.4
rather than a FortiGate unit with a private network behind it.
Figure 157:Load balance virtual IP for an IP address range
To add a load balance virtual IP for an IP address range
1 Go to Firewall > Virtual IP > Virtual IP.
2 Select Create New.
Source Interface/Zone external
Source Address Name All (or a more specific address)
Destination Interface/Zone dmz1
Destination Address Name Port_fwd_NAT_VIP_port_range
Schedule always
Service HTTP
Action ACCEPT
To Next Page
Loading...
Need help?
General