164 Fortinet Inc.
Adding an IP pool Firewall configuration
4Select OK to save the policy.
IP pools
An IP pool (also called a dynamic IP pool) is a range of IP addresses added to a
firewall interface. If you add IP pools to an interface, you can select Dynamic IP Pool
when you configure a policy with the destination set to this interface. You can add an
IP pool if you want to add NAT mode policies that translate source addresses to
addresses randomly selected from the IP pool rather than being limited to the IP
address of the destination interface.
For example, if you add an IP pool to the internal interface, you can select Dynamic IP
pool for Ext->Int and DMZ->Int policies.
The addresses in the IP pool must be on the same subnet as the IP address of the
interface. For example, if the IP address of a FortiGate interface is 192.168.1.99, a
valid IP pool could start IP at 192.168.1.10 and end at 192.168.1.20. This IP pool
would give the firewall 11 addresses to select from when translating the source
address.
The addresses in the IP pool range cannot conflict with other addresses on the same
network as the interface for which you are adding the IP pool.
You can add multiple IP pools to any interface, but only the first IP pool is used by the
Firewall.
This section describes:
•Adding an IP pool
•IP Pools for firewall policies that use fixed ports
•IP pools and dynamic NAT

Adding an IP pool

To add an IP pool:
1Go to Firewall > IP Pool.
2Select the interface to which to add the IP pool.
3Select New to add a new IP pool to the selected interface.
4Enter the Start IP and End IP addresses for the range of addresses in the IP pool.
The Start IP and End IP must define the start and end of an address range. The Start
IP must be lower than the End IP. The Start IP and End IP must be on the same
subnet as the IP address of the interface for which you are adding the IP pool.
If you have configured the external interface to use PPPoE or DHCP, you can only set
the Start IP and End IP to the current IP address of the external interface.
Authentication Optionally select Authentication and select a user group to require
users to authenticate with the firewall before accessing the server
using port forwarding.
Log Traffic
Anti-Virus & Web filter
Select these options to log port-forwarded traffic and apply antivirus
and web filter protection to this traffic.