Firewall Virtual IP IP pools
FortiGate Version 3.0 MR4 Administration Guide
01-30004-0203-20070102 269
IP pools
Use IP pools to add NAT policies that translate source addresses to addresses
randomly selected from the IP pool rather than being limited to the IP address of
the destination interface.
An IP pool defines an address or a range of IP addresses, all of which respond to
ARP requests on the interface to which the IP pool is added.
Select Enable Dynamic IP Pool in a firewall policy to translate the source address
of outgoing packets to an address randomly selected from the IP pool. An IP pool
list appears when the policy destination interface is the same as the IP pool
interface.
With an IP pool added to the internal interface, you can select Dynamic IP pool for
policies with the internal interface as the destination.
Add multiple IP pools to any interface and select the IP pool to use when
configuring a firewall policy.
A single IP address is entered normally. For example, 192.168.110.100 is a valid
IP pool address. If an IP address range is required, use either of the following
formats.
• x.x.x.x-x.x.x.x, for example 192.168.110.100-192.168.110.120
• x.x.x.[x-x], for example 192.168.110.[100-120]
IP pools and dynamic NAT
Use IP pools for dynamic NAT. For example, an organization might have
purchased a range of Internet addresses but has only one Internet connection on
the external interface of the FortiGate unit.
Assign one of the organization’s Internet IP addresses to the external interface of
the FortiGate unit. If the FortiGate unit is operating in NAT/Route mode, all
connections from the network to the Internet appear to come from this IP address.
For connections to originate from all the Internet IP addresses, add this address
range to an IP pool for the external interface. Then select Dynamic IP Pool for all
policies with the external interface as the destination. For each connection, the
firewall dynamically selects an IP address from the IP pool to be the source
address for the connection. As a result, connections to the Internet appear to be
originating from any of the IP addresses in the IP pool.
IP Pools for firewall policies that use fixed ports
Some network configurations do not operate correctly if a NAT policy translates
the source port of packets used by the connection. NAT translates source ports to
keep track of connections for a particular service. Select fixed port for NAT
policies to prevent source port translation. However, selecting fixed port means
that only one connection can be supported through the firewall for this service. To
be able to support multiple connections, add an IP pool to the destination
interface, and then select dynamic IP pool in the policy. The firewall randomly
selects an IP address from the IP pool and assigns it to each connection. In this
case the number of connections that the firewall can support is limited by the
number of IP addresses in the IP pool.
To Next Page
Loading...
Need help?
General