Port Forwarding from different Sources

[bbbmp3]

We have a Cisco 878 router with a Fortigate 100A behind it the Cisco creates a IPSEC VPN for a certain application to an industry based Web portal, what I want to be able to do is create another IPSEC site to site VPN between the Fortigate 100A at this site and another Fortigate at another site.
I can do this if I forward UDP 500 and 4500 through the Cisco to the Fortigate but this stops the Cisco' own VPN as I have explained above.
Is there any way of forwarding ports 500 and 4500 that come from 1 Static external IP address so that the Cisco can use its VPN and 500 & 4500 from the other site can create the Fortigate to Fortigate VPN

 

[burtsbees]

ip nat inside source static tcp (fortinet_inside_ip) 500 int (outside_interface) 500

Same for port 4500. You need a static NAT translation from the public IP to the private and vice-versa.

Burt

 

[bbbmp3]

Doesn't that command forward all traffic on port 500 to the internal address specified ?
ip nat inside source static udp 192.168.3.2 500 interface Dialer0 500
I have already removed this as it affects the Cisco's VPN
I want to forward traffic from only the 1 external static address from 2nd site through to the Fortigate.
Or would a better option be to forward all ports from the second site to the Fortigate

 

[burtsbees]

Either replace this
interface Dialer0 500
with the IP address of the fortinet, or maybe it's like that except with an outside source...
ip nat outside source tcp IP_OF_FORTINET 500 192.168.x.x 500
Something like that---I have never had any reason to use an outside NAT translation...let me research this...at least we now have a foundation on what to research now...

Burt

 

[bbbmp3]

If I do a one to one static NAT translation so that all traffic from the external IP off the second sitye is passed through to the Fortigate willthis work ?

 

[burtsbees]

I would think, yes...

Burt

 

[Minue]

Hello
The access-list just permits traffic to that inside host.To port forward you will need the below command:

ip nat inside source static tcp 192.168.1.10 143 interface Ethernet1 143

If this doesn’t work try with a basic conf,then once you get it working put the Firewall stuff later.Also make sure you cable Modem is forwarding all ports.

Regards