Many to one NAT and destination filtering Fortigate 100D

[zarn]

I have many to one NAT set up with one VLAN under the LAN interface uses the external IP of the fw for internet.

My switch connects to internet with the firewall WAN interface hooked up to it. On the switch I have routable hosts.

The problem i am having is I cannot make the rule granular and block access to certain routable ips on the switch. Once I uses the source and destination in the policy it does not allow me to make a new rule.

Also it does not seem like Fortigate supports negatives in rules (as in !10.10.10.10 - being NOT 10.10.10.10). So I am stuck with a rule allowing granularity of protocols allowed but not destinations (it's either all or nothing).

Is there any way to do this?

[Toshi_Esumi]

You just need to place an opposite rule for 10.10.10.10 first, let's say "deny", then place an "accept" rule for "all" right after it. It would accomplish "NOT 10.10.10.10/32", "accept" rule.

[zarn]

Actually I thought of that but it does not allow me to select these objects once used in one rule already....

[Toshi_Esumi]

No, you never need to use the object twice although it should be allowed. You must have created an address object like "10.10.10.10/32", then the first policy uses it as a destination to deny. Then the second policy uses "all" for the destination and set accept. That's all you need to do to "allow all destinations except 10.10.10.10". You can do the same with source addresses.

[ede_pfau]

At least in FOS v5.4 and v5.6, you can set an option in a policy to negate the source and/or destination address:

config firewall policy

   set srcaddr-negate               When enabled srcaddr specifies what the source address must NOT be.
   set dstaddr-negate               When enabled dstaddr specifies what the destination address must NOT be.

[Toshi_Esumi]

Thanks Ede, I never knew that.

http://kb.fortinet.com/kb....do?externalID=FD33959