Fortinet Fortigate-5000 series Administration Manual page 262

Configuring virtual IPs
262
Figure 156:Static NAT virtual IP port forwarding for an IP address range and a port
range example
To add static NAT virtual IP port forwarding for an IP address range and a
port range
1 Go to Firewall > Virtual IP > Virtual IP.
2 Select Create New.
3 Use the following procedure to add a virtual IP that allows users on the Internet to
connect to a web server on the DMZ network. In our example the external
interface of the FortiGate unit is connected to the Internet and the dmz1 interface
is connected to the DMZ network.
Name
External Interface
Type
External IP Address/Range The external IP addresses must be static IP addresses
Map to IP/IP Range
Port Forwarding
Protocol
External Service Port
Map Port
4 Select OK.
Port_fwd_NAT_VIP_port_range
external
Static NAT
obtained from your ISP. This addresses must be unique, not
used by another host, and cannot be the same as the IP
address of the external interface the virtual IP will be using.
However, the external IP addresses must be routed to the
selected interface. The virtual IP addresses and the external
IP address can be on different subnets. When you add the
virtual IP, the external interface responds to ARP requests for
the external IP addresses.
The IP addresses of the server on the internal network.
Define the range by entering the first address of the range in
the first field and the last address of the range in the second
field.
Selected
TCP
The ports that traffic from the Internet will use. For a web
server, this will typically be port 80.
The ports on which the server expects traffic. Define the
range by entering the first port of the range in the first field
and the last port of the range in the second field. If there is
only one port, leave the second field blank.
FortiGate Version 3.0 MR4 Administration Guide
Firewall Virtual IP
01-30004-0203-20070102