VIP source address question

FOrtiBen · ‎03-30-2019

Hi,

I have configured VIP (1:1 NAT) to allow external SFTP access from the internet into our server. The connection works but why the source address logged on the FTP server is the internal LAN IP address of the Fortigate instead of the actual src add of the SFTP client? Is this a normal behaviour of Fortigate? Is there a way to force the FortiGate not to replace the original src add?

Thanks in advance.

Markus · ‎03-30-2019

Hi and welcome to the forums I assume you have Nat enabled. Just disable Nat on the policy. Best

________________________________________________________
--- NSE 4 ---
________________________________________________________

ede_pfau · ‎03-30-2019

The NAT checkbox in the policy setup enforces source NAT to the address of the outbound interface. You only want to use VIP for destination NAT.

Ede

"Kernel panic: Aiee, killing interrupt handler!"

FOrtiBen · ‎03-31-2019

Thank you all. Unticking the NAT box on the policy works.