Fortinet FortiGate Series Administration Manual page 413

Firewall Policy
FortiGate Version 4.0 MR1 Administration Guide
01-410-89802-20090903
http://docs.fortinet.com/ • Feedback
dst-port: 80
And the other index is for traffic flowing in the opposite/reply direction:
src-ip: 172.20.120.2
dst-ip: 192.168.1.1
proto: tcp
src-port: 80
dst-port: 46372
Where 46372 is the chosen NAT port. In both cases when traffic matches either of these
indexes the session that the traffic belongs to can be uniquely identified.
Using a per NAT IP, destination IP, port, and protocol pool, when choosing the NAT port
FortiOS only has to ensure that the chosen port combined with the other four attributes are
unique to uniquely identify the session. So for example, if student A simultaneously makes
a connection to the search engine (destination IP address 172.20.120.2) on port 443 this
would create another session and the index in the reply direction would be:
src-ip: 172.20.120.2
dst-ip: 192.168.1.1
proto: tcp
src-port: 443
dst-port: NP
The value of NP can be any value as long as the five values together are unique. For
example, FortiOS could choose 46372 again:
src-ip: 172.20.120.2
dst-ip: 192.168.1.1
proto: tcp
src-port: 443
dst-port: 46372
This is acceptable because:
src-ip: 172.20.120.2
dst-ip: 192.168.1.1
proto: tcp
src-port: 80
dst-port: 46372
and
src-ip: 172.20.120.2
dst-ip: 192.168.1.1
proto: tcp
src-port: 443
dst-port: 46372
have different src-port values.
The result of using the per NAT IP, destination IP, port, and protocol pool approach is that
a pool of 32768 ports are available for each unique combination of src-ip, dst-ip,
proto and src-port.
The maximum number of simultaneous connections that can be supported is
N*R*P*D*Dp where N is the number of NAT IP addresses, R is the port range, P is the
number of protocols, D is the number of unique destination IP addresses and Dp the
number of unique destination ports.
Considering the large number of destination IP addresses available, the number of
simultaneous connections that can be supported is very large. To get an idea of how
large, for one destination IP address and one NAT IP address the calculation would be
N=1, R=32, 768, P=2, D=1 and Dp=32,768:
How FortiOS selects unused NAT ports
413