{"id":83,"date":"2022-03-11T04:22:20","date_gmt":"2022-03-11T09:22:20","guid":{"rendered":"https:\/\/opentextbc.ca\/fortigatefirewall\/chapter\/source-nat\/"},"modified":"2023-08-29T16:26:20","modified_gmt":"2023-08-29T20:26:20","slug":"source-nat","status":"publish","type":"chapter","link":"https:\/\/opentextbc.ca\/fortigatefirewall\/chapter\/source-nat\/","title":{"raw":"3.1 Source NAT","rendered":"3.1 Source NAT"},"content":{"raw":"
\n

Learning Objectives<\/p>\n\n<\/header>\n

\n
    \n \t
  • Configure a NAT policy in FortiGate<\/li>\n \t
  • Identify source NAT<\/li>\n<\/ul>\n<\/div>\n<\/div>\n
    Scenario<\/strong>: We are going to enable Source NAT (SNAT) to reach the Internet from Kali. That means that all traffic from the local network to the Internet should be allowed.<\/div>\n \n\n[caption id=\"attachment_76\" align=\"aligncenter\" width=\"1125\"]\" Figure 3.1: Main scenario[\/caption]\n

    Source NAT<\/h2>\n
    \n\n\n\n\n\n\n\n
    Table 3.1: Devices configuration<\/caption>\n
    Device<\/th>\nIP address<\/th>\nAccess<\/th>\n<\/tr>\n
    Kali<\/td>\nDHCP Client<\/td>\n-<\/td>\n<\/tr>\n
    WordPress\/Kali<\/td>\nDHCP Client<\/td>\n-<\/td>\n<\/tr>\n
    Ethernet Switch<\/td>\n-<\/td>\n-<\/td>\n<\/tr>\n
    FortiGate<\/td>\nPort 2 - (192.168.1.1\/24) - DHCP Server (192.168.1.10 to 192.168.1.20)\n\nPort 3 - DHCP Client\n\nPort 4 - 10.10.10.1\/24<\/td>\nICMP-HTTP-HTTPS<\/td>\n<\/tr>\n
    WebTerm<\/td>\n10.10.10.2\/24<\/td>\n-<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

    Basic Configuration<\/h2>\n
      \n \t
    1. Port configuration in the firewall as follows:\n\n[caption id=\"attachment_77\" align=\"aligncenter\" width=\"930\"]\"Port Figure 3.2: Ports configuration in the firewall[\/caption]<\/li>\n \t
    2. Set a DHCP server on interface port2 (Range of IP address should be: 192.168.1.10 to 192.168.1.20, DNS: 4.2.2.4).\n\n[caption id=\"attachment_78\" align=\"aligncenter\" width=\"400\"]\"Set Figure 3.3: DHCP Server configuration[\/caption]<\/li>\n \t
    3. Set port3 as a DHCP client and connect to the NAT.\n\n[caption id=\"attachment_79\" align=\"aligncenter\" width=\"450\"]\"Set Figure 3.4: DHCP client configuration[\/caption]<\/li>\n \t
    4. Set a static route in the firewall to reach to NAT object.\n\n[caption id=\"attachment_80\" align=\"aligncenter\" width=\"648\"]\"Set Figure 3.5: Set a static route[\/caption]<\/li>\n \t
    5. Go to Policy & Objects > Firewall Policy<\/strong> section, click Create New<\/strong> to add a new firewall policy, and configure the following settings:\n
        \n \t
      • Name: LocalToInternet<\/strong><\/li>\n \t
      • From inside to outside (port2 to port3)<\/strong><\/li>\n \t
      • Source: Create an address for the local network<\/strong> (Subnet: 192.168.1.0\/24)<\/li>\n \t
      • Destination: all<\/strong><\/li>\n \t
      • Schedule: Always<\/strong><\/li>\n \t
      • Service: Only HTTP, HTTPS, and DNS<\/strong><\/li>\n \t
      • Action: Accept<\/strong><\/li>\n<\/ul>\n[caption id=\"attachment_81\" align=\"aligncenter\" width=\"648\"]\"Configure Figure 3.6: Configure Firewall Policy and enable Source NAT[\/caption]<\/li>\n \t
      • Open the browser in Kali, you should be able to access the internet.\n\n[caption id=\"attachment_82\" align=\"aligncenter\" width=\"500\"]\"you Figure 3.7: Verify your configuration[\/caption]<\/li>\n<\/ol>","rendered":"
        \n
        \n

        Learning Objectives<\/p>\n<\/header>\n

        \n
          \n
        • Configure a NAT policy in FortiGate<\/li>\n
        • Identify source NAT<\/li>\n<\/ul>\n<\/div>\n<\/div>\n
          Scenario<\/strong>: We are going to enable Source NAT (SNAT) to reach the Internet from Kali. That means that all traffic from the local network to the Internet should be allowed.<\/div>\n

           <\/p>\n

          \"Source
          Figure 3.1: Main scenario<\/figcaption><\/figure>\n

          Source NAT<\/h2>\n
          \n\n\n\n\n\n\n\n\n
          Table 3.1: Devices configuration<\/caption>\n
          Device<\/th>\nIP address<\/th>\nAccess<\/th>\n<\/tr>\n
          Kali<\/td>\nDHCP Client<\/td>\n–<\/td>\n<\/tr>\n
          WordPress\/Kali<\/td>\nDHCP Client<\/td>\n–<\/td>\n<\/tr>\n
          Ethernet Switch<\/td>\n–<\/td>\n–<\/td>\n<\/tr>\n
          FortiGate<\/td>\nPort 2 – (192.168.1.1\/24) – DHCP Server (192.168.1.10 to 192.168.1.20)<\/p>\n

          Port 3 – DHCP Client<\/p>\n

          Port 4 – 10.10.10.1\/24<\/td>\n

          		ICMP-HTTP-HTTPS<\/td>\n<\/tr>\n
          WebTerm<\/td>\n10.10.10.2\/24<\/td>\n–<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

          Basic Configuration<\/h2>\n
            \n
          1. Port configuration in the firewall as follows:
            \n
            \"Port
            Figure 3.2: Ports configuration in the firewall<\/figcaption><\/figure>\n<\/li>\n
          2. Set a DHCP server on interface port2 (Range of IP address should be: 192.168.1.10 to 192.168.1.20, DNS: 4.2.2.4).
            \n
            \"Set
            Figure 3.3: DHCP Server configuration<\/figcaption><\/figure>\n<\/li>\n
          3. Set port3 as a DHCP client and connect to the NAT.
            \n
            \"Set
            Figure 3.4: DHCP client configuration<\/figcaption><\/figure>\n<\/li>\n
          4. Set a static route in the firewall to reach to NAT object.
            \n
            \"Set
            Figure 3.5: Set a static route<\/figcaption><\/figure>\n<\/li>\n
          5. Go to Policy & Objects > Firewall Policy<\/strong> section, click Create New<\/strong> to add a new firewall policy, and configure the following settings:\n
              \n
            • Name: LocalToInternet<\/strong><\/li>\n
            • From inside to outside (port2 to port3)<\/strong><\/li>\n
            • Source: Create an address for the local network<\/strong> (Subnet: 192.168.1.0\/24)<\/li>\n
            • Destination: all<\/strong><\/li>\n
            • Schedule: Always<\/strong><\/li>\n
            • Service: Only HTTP, HTTPS, and DNS<\/strong><\/li>\n
            • Action: Accept<\/strong><\/li>\n<\/ul>\n
              \"Configure
              Figure 3.6: Configure Firewall Policy and enable Source NAT<\/figcaption><\/figure>\n<\/li>\n
            • Open the browser in Kali, you should be able to access the internet.
              \n
              \"you
              Figure 3.7: Verify your configuration<\/figcaption><\/figure>\n<\/li>\n<\/ol>\n","protected":false},"author":124,"menu_order":3,"template":"","meta":{"pb_show_title":"on","pb_short_title":"","pb_subtitle":"","pb_authors":[],"pb_section_license":""},"chapter-type":[],"contributor":[],"license":[],"class_list":["post-83","chapter","type-chapter","status-publish","hentry"],"part":75,"_links":{"self":[{"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/83","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters"}],"about":[{"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/wp\/v2\/types\/chapter"}],"author":[{"embeddable":true,"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/wp\/v2\/users\/124"}],"version-history":[{"count":1,"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/83\/revisions"}],"predecessor-version":[{"id":84,"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/83\/revisions\/84"}],"part":[{"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/parts\/75"}],"metadata":[{"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/83\/metadata\/"}],"wp:attachment":[{"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/wp\/v2\/media?parent=83"}],"wp:term":[{"taxonomy":"chapter-type","embeddable":true,"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapter-type?post=83"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/wp\/v2\/contributor?post=83"},{"taxonomy":"license","embeddable":true,"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/wp\/v2\/license?post=83"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}