
Adding an IP pool | Firewall configuration |
|
|
Authentication | Optionally select Authentication and select a user group to require |
| users to authenticate with the firewall before accessing the server |
| using port forwarding. |
Log Traffic | Select these options to log |
4Select OK to save the policy.
IP pools
An IP pool (also called a dynamic IP pool) is a range of IP addresses added to a firewall interface. If you add IP pools to an interface, you can select Dynamic IP Pool when you configure a policy with the destination set to this interface. You can add an IP pool if you want to add NAT mode policies that translate source addresses to addresses randomly selected from the IP pool rather than being limited to the IP address of the destination interface.
For example, if you add an IP pool to the internal interface, you can select Dynamic IP pool for
The addresses in the IP pool must be on the same subnet as the IP address of the interface. For example, if the IP address of a FortiGate interface is 192.168.1.99, a valid IP pool could start IP at 192.168.1.10 and end at 192.168.1.20. This IP pool would give the firewall 11 addresses to select from when translating the source address.
The addresses in the IP pool range cannot conflict with other addresses on the same network as the interface for which you are adding the IP pool.
You can add multiple IP pools to any interface, but only the first IP pool is used by the Firewall.
This section describes:
•Adding an IP pool
•IP Pools for firewall policies that use fixed ports
•IP pools and dynamic NAT
Adding an IP pool
To add an IP pool:
1Go to Firewall > IP Pool.
2Select the interface to which to add the IP pool.
3Select New to add a new IP pool to the selected interface.
4Enter the Start IP and End IP addresses for the range of addresses in the IP pool.
The Start IP and End IP must define the start and end of an address range. The Start IP must be lower than the End IP. The Start IP and End IP must be on the same subnet as the IP address of the interface for which you are adding the IP pool.
If you have configured the external interface to use PPPoE or DHCP, you can only set the Start IP and End IP to the current IP address of the external interface.
164 | Fortinet Inc. |