Fortinet FortiGate FortiGate-50R Installation And Configuration Manual page 117

Firewall configuration
FortiGate-50R Installation and Configuration Guide
For NAT/Route mode policies where the address on the destination network is hidden
from the source network using NAT, the destination can also be a virtual IP that maps
the destination address of the packet to a hidden destination address. See
IPs" on page 131.
Schedule
Select a schedule that controls when the policy is available to be matched with
connections. See "Schedules" on page
Service
Select a service that matches the service (port number) of the packet. You can select
from a wide range of predefined services or add custom services and service groups.
See "Services" on page
Action
Select how the firewall should respond when the policy matches a connection attempt.
ACCEPT Accept the connection. If you select ACCEPT, you can also configure NAT
and Authentication for the policy.
DENY Deny the connection. The only other policy option that you can configure is
log traffic, to log the connections denied by this policy.
ENCRYPT Make this policy an IPSec VPN policy. If you select ENCRYPT, you can
select an AutoIKE key or Manual Key VPN tunnel for the policy and configure
other IPSec settings. You cannot add authentication to an ENCRYPT policy.
ENCRYPT is not available in Transparent mode. See
policies" on page
NAT
Configure the policy for NAT. NAT translates the source address and the source port
of packets accepted by the policy. If you select NAT, you can also select Dynamic IP
Pool and Fixed Port. NAT is not available in Transparent mode.
Dynamic IP You cannot select Dynamic IP Pool for Int->Ext policies if the external
interface is configured using DHCP or PPPoE.
Pool
Select Dynamic IP Pool to translate the source address to an address
randomly selected from an IP pool added to the destination interface of the
policy. To add IP pools, see
Fixed Port Select Fixed Port to prevent NAT from translating the source port. Some
applications do not function correctly if the source port is changed. If you
select Fixed Port, you must also select Dynamic IP Pool and add a dynamic
IP pool address range to the destination interface of the policy. If you do not
select Dynamic IP Pool, a policy with Fixed Port selected can only allow one
connection at a time for this port or service.
129.
125.
168.
"IP pools" on page
Adding firewall policies
"Virtual
"Configuring encrypt
135.
117