Fortinet FortiGate 60R, Installation And Configuration Manual

Page: 162 / 270

162
Fortinet Inc.
IP pools Firewall configuration
4 Select OK to save the policy.
IP pools
An IP pool (also called a dynamic IP pool) is a range of IP addresses added to a
firewall interface. If you add IP pools to an interface, you can select Dynamic IP Pool
when you configure a policy with the destination set to this interface. You can add an
IP pool if you want to add NAT mode policies that translate source addresses to
addresses randomly selected from the IP pool rather than being limited to the IP
address of the destination interface.
For example, if you add an IP pool to the internal interface, you can select Dynamic IP
pool for WAN1
->
Internal, WAN2
->
Internal and DMZ
->
Internal policies.
The addresses in the IP pool must be on the same subnet as the IP address of the
interface. For example, if the IP address of a FortiGate interface is 192.168.1.99, a
valid IP pool could start IP at 192.168.1.10 and end at 192.168.1.20. This IP pool
would give the firewall 11 addresses to select from when translating the source
address.
The addresses in the IP pool range cannot conflict with other addresses on the same
network as the interface for which you are adding the IP pool.
You can add multiple IP pools to any interface, but only the first IP pool is used by the
Firewall.
This section describes:
• Adding an IP pool
• IP Pools for firewall policies that use fixed ports
• IP pools and dynamic NAT
Adding an IP pool
To add an IP pool:
1 Go to Firewall > IP Pool .
2 Select the interface to which to add the IP pool.
3 Select New to add a new IP pool to the selected interface.
4 Enter the Start IP and End IP addresses for the range of addresses in the IP pool.
The Start IP and End IP must define the start and end of an address range. The Start
IP must be lower than the End IP. The Start IP and End IP must be on the same
subnet as the IP address of the interface for which you are adding the IP pool.
If you have configured the WAN1 or WAN2 interface to use PPPoE or DHCP, you can
only set the Start IP and End IP to the current IP address of the WAN1 or WAN2
interface.
Authentication Optionally select Authentication and select a user group to require
users to authenticate with the firewall before accessing the server
using port forwarding.
Log Traffic
Anti-Virus & Web filter Select these options to log port-forwarded traffic and apply antivirus
and web filter protection to this traffic.