Fortinet NSE4_FGT-7.2 — FortiGate Firewall — Section 1: FortiGate Firewall V6.4 1 Part 40

55. Lecture-55: Destination NAT, Virtual IP in Security Policy.

Another topic is destination network address translation in shotput recorded on this name.

So, basically what happened in destination and destination near your destination, IP changed and your destination board changed.

So, in this scenario, we call the destination route and we’ll be using when somebody from outside in real world and they want to access any server, which is insert your in front, maybe it will be in your Remzi. It can be anywhere inside and they want to exit their someone so far away, but it must be held to career destination rather than to create a source named. Because somebody will come from public network to exist. You’re someone and these are what is a private IP society, which is you are using inside your water and maybe you are using one that you do 168, maybe 10, Daquan one something and maybe once I want to do something. Which is not accessible directly from old site, and either you have to assign public IP Dudly to the server and you have to expose yourself directly, which is not a good practice.

So, what we do, we create a destination. It. From outside, the people will head my old side in the face of fire while my public image is exposed to the outside world, and when they heard my source, they’re thinking, this is this this is a whipsaw.

So, the old people will think this is absurd. What IP, which is not in reality.

So, in their head, this somewhere so far, the world really changed the destination. What was the destination? This this also be somebody from outside. They had this IP, which is one one four narked hunter. They will change their destination. Look at you are wrong. Basically I’m doing translation. I will change the destination IP to the actual IP. A IP this way because immodesty nation name and this scenario now that this dimension is changing.

So, we call, they want to see it in simple words.

So, let’s go to the end destination. We will follow the same Leyb which reconfigure our source name. But in source Knabe we were going from inside to here. This way our source was changing. One guard, one, one, two and three was changing to decide the exact IP, either pull up IP or the border and whatever. We did so many big. But this time the scenario has changed.

Somebody from intimate, they will exist somewhere with someone and they will exist or some other someone.

So, now is opposite direction, so in opposite direction, now they’re doing more and more of my private eye because she’s wonderful. Let me go to the actual one. This one.

So, basically, don’t lie about anything about my lookalike, which is one part for the one, part three, this one, the subtle one.

So, what they will do, they will hit the firewall to be one one four, not after a public radio fired one. Then I will configure a destination that if somebody hit you on your public IP one one four hundred forty eight report, give it to this guy. I will make them. Then I will say if somebody hit you on one one four hundred and twenty three people, give it to this guy. If somebody hit you on one one four twenty two people give it to the same this guy and so on. For every services you have to create your destination names. If you have a one on one working for everything, then you go into any port. If somebody hit you on any board, give it to this guy. But barely. I will create one rule that if anybody coming from outside hiding out inside an audit.

So, I need to think then this piece will be put here. If I get it from here right now, it would be not accessible because this not makes sense. If this is my Web server, which is 192 168, Wal-Mart three, it’s not possible how I can excuse a private eye periodically from external services. But I retired because you were not allowed on me, so I’m not reachable. Okay, maybe I will think that I will hit one point for dot com, but still I will be not accessible because we’re busy. And also the phone line is open.

So, don’t worry about that because I said in the press, I’m using quadrivalent.

So, that’s why it’s open this one. But ignore it like you think it will be not accessible. And if I do divinities well, it will not work. Let me do it in it from here. Nothing will work because there is no rule and neither something is figure. I don’t get it is. Yeah, so if I try to access tonight. 190 to 168, 114. It is not working, didn’t it? Because I’m not treated with the and also, even if I heard the one 100 student, not people and probably could be because there is no such, you know, maybe you are thinking that the little is not going to be good. Here, let me configure on one is very quickly. I suppose if it is not healthy for me, that’s never been done. But anyway, sure, I believe atheist is a the line. Are you suitable for transport in football and password. One, two, three. And login didn’t hurt image but now it’s in. And one password, one, two, three, do, right. Still, it’s not possible neither the public should be neither on private.

So, what I need I need to think, Paul, as you do a lot and destination it how I can do so. Let me go to firewalled eight men. One, two, three. Remind me later. Now I need to create a destination for this purpose. But again, this commission that can be with Centrelink and it can be without a central mate, if it is through Centrelink, then there will be this one like a destination net and Wurtulla, it will show like this.

So, let me do with Old Central.

So, what I need to do, I need to go to system system sitting and learning disabled Santoni. Okay. Let me check if the Internet is your viral energy, Oswestry, move now to look at this change to what your life is, what your life is, nothing but a destination named.

So, let’s create a destination near how we can configure to go to policy and object to what it will be. Nothing is going to be good. It’s just like a name Dudin Interface Services in reference, just we using every word like the same thing.

So, they’re saying, what will it be and what will be with Google, who can create a group as well? And what should I say right now? I need one. What will I be.

So, what name you want to give, why is it suppose with someone we riverside we were to like the destination named for this one for this site? What I’m creating coming, Jane, any color you want to give, suppose any color of this I can to create interface from where it will come.

So, I say probably from when you get to any as welli to local and external IP range. And may I be addressed so externalise, it will be one nine two one six eight one one four Gartenberg, it’s my external interface. I’ve been getting Granges with many of them to my local IP, which is 192 168 one, up three this one.

So, I will say one nine two one six eight one three. This optional filter, do you want to apply any like a dress should be this one, either you want out of services.

So, I say service is a good idea. This will be HTTP only. Out of maybe a city person, you want to only to be here, but anyway, let me make them EDP.

So, I said yes, only for HTTP traffic will come, which is a report. And do you want any specific board to change when we’re talking? So, my destination, it is really when we knew where somebody hit one one 400 might public IPO, public IP for 84, it will be reedited to one to three. And this concept, we call them Destination Enoki. But I need a policy from all sides to end the policy, which I hear right now. This is from Lane to win, so I need to allow the traffic is.

So, here I will see if somebody from Lane coming to learn from when they are now creating opposite policy lane. The source can you can specify if somebody specific is coming destination. You can create an interest group for the same server, this one 100 168, which will create a bit later. Anyway, right now I will sit on any time you can put restriction and services, you can put restriction either against it. HHTTP, which is already there as well, and action is allowed. Its mission was this one and I don’t need named because I disable Santander.

So, this one is coming here again. And I will say a, the Alsatian in Orchid, because if I allowed here, it will be a double date.

So, I don’t need I need a destination. Okay, so now let’s go to the system and there will be a small issue. I need to test another set services because ETP is used by this one as well.

So, I don’t think so. They will. I need to test a little something for this, but what I can do, let me go to network interface. I just realized there is one small issue because I’m using Rand for my own purposes. Really, we have somebody hit on this one, so it will show this one.

So, I need to remove for a while. But then how I will again, this is an issue, so let me enable them on my inside. For this purpose, I need to create another service. Anyway, I just created so, uh, let me enable HHTTP is a. And that move from outside. Okay, so I will be disconnected. What to do, I need to question those services.

So, let’s go back to inaudible. No, simple. Is there definitely somebody here? It will be near not redacted because SCDP is enabling this somewhat when which is not to be enable and real where. It’s not possible because I’m taking management here, so let’s make a dent in it because we enable the interior.

So, let me show you from Interservices. Let’s go back to our policy object. What like and change the rule which I created is a web. Make them alert Internet. Just give them any memories and change will be my television for and let me make them for and change this one to donate. Okay, and you must be in okay, and what do I do for policy and tell them that somebody from way into them when they’re coming from services you can put on, is it because you already put their investigation? But anyone who can put them in here is a bit more specific. I know, Ken. Okay. It’s it now let’s try again before 10:00. It was not accessible, I think we drive from here now. Let’s see if I heard the public I’d be a firewall to be around to. Let’s see, I say one one four, not 100, so we can figure out our destination if somebody hit on one one four hundred Futter and so do you drive them to the other one? So, I just need to check in on one one thing that I noticed there, unmarked. It is not there. Then it will not go back to the road. He has to deal with this dude.

So, it has to work in Okarma to see someone who is logging in here.

So, not yet anybody is coming here.

So, let’s wait for the one sometime in state time. But it has to be okay. Let’s see if I can see the traffic. I I can see one more thing maybe I involved in an outside interfaces with.

So, I hope it is not a. Well, kipping is alone and it’s his age you want to know of associations with. Either way, it will go to our next one, so. Okay, by the way, it has to autocratically and then we can check for FPP services as these two services, unfortunately on Ivin interface also enable so they toyi, but in reality, one one four, not hundred, and of how we can verify if we go to log’s and report forward in traffic. Okay, from forwarding traffic, what you can do, enable destination and there will be something destination and there’s the destination IP and destination board. These two things that we’re required to see.

So, it will be enabled here. Okay, so then bring here to this source so that we can check them properly. Leave it here, it’s not training properly, so all the sources, okay, little refresher, something is coming here on our air traffic.

So, no destination is here.

So, it means the services we are trying. Either allowed how we can verify if I go to console eight men, one, two, three configure system interface, which board and board number one and said it exists. It now exists. I didn’t. Maybe if we can see. Sure.

So, sick to you being, you know, to do this, you know. It’s not enough. I just to confirm time is not showing during traffic, but it is a here.

So, if it is inaudible to to this IP rather than to forward them.

So, that’s why it was just to check out.

So, it’s not working. What we can do let’s just another of otherwise than we have done some mistake.

So, let’s go back to policy and update it before. And it’s really for a first date. My policy is clear properly from way to learn and let’s do it. Honestly, that’s not an issue. And. And should follow. No need for the way need talk and everything is okay. You’re in the policy. Nothing is wrong, and now let’s go to will be and check double check the rule.

So, from outside the city, be okay and at one dart borders my. Out of one eye, you have not. Okay. Wonderful. Correct. Okay, and the soloist is only 10. Okay, so it means everything is great, but the only thing is so what we do, let’s test FPP. This sort is FTB as so support is not working, then the issue is something else.

So, how we can do more to work will be and create a new work will be this time if piece or samples. Anything coming from within and externalised is 190 to 160 here, one one four harder and might if need be said. What is this one? Three, what do you do, be 190, 192, 160, 133. Okay, and Services’s if.

So, let me choose it to be an okay and okay, oh, we can test so from here. I won’t say if deep and 190 to 168 one one four FTB is bumped, so it means there is some other issue we need to fix it. If it is not, then we have to troubleshoot what is the issue.

So, I will hurt the public IP, which is one one four Dortmunder a firewall for FTB, but we can forget our destination network. Will the traffic to the. It’s just not coming. It means I’m doing something wrong. Let me go quickly. Maybe I missed something.

So, let’s move quickly. Everything is to be good. This we created or not for Ken.

So, this one was with scintillate, so I’m doing this with the old center named, so by the way, it has to. Oh, no, basically, I’m doing without Internet, so maybe one thing more I need to know. Net.

Something is wrong, which I did not see were right and wrong when the policy of the area were to learn. Okay. Everything I know is not made this one, but.

So. Let me check, maybe I’m not reachable here being 190 to 160, everyone, one for me, you know, somebody who was there and doing it on for 21. Let’s see and check the laws of this policy when Tulane is hitting on.

So, let me refresh.

So, it’s not hating let me make this policy on the door. Take this one down. Okay, so to. I, me.

So, let me move them up. I just want to see maybe. Create a new one.

So, my traffic is not hurting for some reason, uh, here. The policy at least. Okay, so I don’t know what I’d done wrong. I need just to check one thing. What would I be doing next year? And if the. Okay, let me change to something else. I do want to be anything, it can be anything. And if we look mentioned by any other, I mean and let’s see if this time. It to her. You can give any a public range, maybe I was just checking my interface I Pinoy give them another IP to test him and I give them this IP 250 IP. Okay, so still, I’m not reachable here. Okay, so let’s inaudible from here, central land, and yet it is giving Iran both either. Okay, sorry. Yes, I mean but I can one mistake if we go to policy. I did not take this one.

So, this is my return to lend policy, what I need to do, the source can be anything and destination. Is this one, if cetera. I don’t know why I forgot this small thing.

So, if I were a kid and now let’s see if I do. Right. It can be the same, no different user name is rude and biosolids Jeunesse three.

So, it will be accessible now and okay, put a username and password. Let me do it again. I saw 200. Because I’m too old to. And let me at age username is rude and sort of Jeunesse three.

So, FDR was not accessible and you will see the traffic is ahead by this rule is now. You will see them here. Look at Celan one for the only thing was I was doing a small mistake. You can say a blender. And this mission you have to mention in the policy which you created like I predicted it and I guarantee you and now Putin and as well both on the same policy and I you can create a super policy.

So, now I can do to alienate as well.

So, if I do turn it, so then it is 450 people, 200 now. I looked at it and it is one, two, three. And if I go to one and if I check here so it will save 192 168 one one for that twenty log into the system. And yes, this is this if I exist and if I see it if config so he one one four twenty is being login but the destination is change. He is hitting the one one phone and when they hit the rearrest this one then instructs led them to detonate one dart for all weekend can verify so to log in and report and forwarding traffic and here you will see the destination there. Now look at it now and there.

Somebody twenty or help me translate them to one dart for what does it. He hit one note for note. He hit one one for Dortmunder. That’s why he is being destination is changed Jayasekara destination name and the other is FPP which is showing 21 four.

So, it’s been translated to one three and the second one which we use last time is if you want to admin one, two, three. Okay and get systems.

Sorry. What was the command to check because he did get a system? Forget the command, skip from my mind. Yeah, gets this transition authority, gives you don’t station families. If I check now, you will see our destination. Look at now. Let me do it again so you can see it again is. If I go to the net and now you will see here, this is 21. If we look at now 21 and 23, what written this to mention it, that somebody here, this IP will translate them to one dart for somebody one one, one for not 200, but we changed them to 133. You got the idea.

So, this is a destination without Centrino named.

So, we don’t seem to like what is the difference? The difference is you have to call your object inside here where I call them. I call them here. Let me show you again, which I forgot this one. You know, this one. What will I be inside when it’s mentioned the word IP instead of one? So, this is my what will I be certain I’ve been nothing but destination named, sorted and installed and if you will, so on. You can create for English services. But we know it will say Internet. You will see these two will disappear. It will be not through here because now we will use this Internet.

So, this is the main difference. I will show you the next one.

So, let me save this one separately.