Enabling Central NAT changes where FortiGate applies source NAT: IPv4 firewall policies stop providing their per-policy NAT setting, and source translation must instead be defined in the Central SNAT table. Firewall policies still decide whether traffic is allowed. In central mode, standalone VIP objects provide destination NAT for inbound traffic, while firewall policies continue to control whether that traffic is accepted.
The safest approach is to inventory current NAT and VIP behavior, prepare equivalent central rules, unassign VIPs from policies before changing modes, then validate representative traffic in a controlled window. Fortinet’s cited guides cover FortiOS 7.0.18, 7.4.7, 7.6.2 and 7.6.6; confirm labels and behavior against the exact FortiOS build and operating mode on your device.
As an Amazon Associate I earn from qualifying purchases.
What changes when you enable Central NAT?
Central NAT separates the security decision from source translation. The firewall policy decides whether a flow is permitted; a Central SNAT rule determines how matching allowed traffic is source-translated. Fortinet’s FortiOS 7.6.6 guide says that when Central NAT is enabled, the NAT option under IPv4 policies is skipped and SNAT must be configured through central-snat-map. It also describes Central SNAT policies as being evaluated after a security policy, from top to bottom, until a match is found. Fortinet: Central SNAT, FortiOS 7.6.6
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →- SNAT moves: Policy-level IPv4 NAT no longer performs the expected source translation; the corresponding central rule must exist.
- DNAT is represented by VIP objects: In central mode, VIPs are separate objects rather than destinations configured as part of a firewall policy. The policy still needs to permit the traffic directed to the translated destination.
- Rule order matters: Central SNAT checks rules top-down and uses the first matching rule. A broad rule placed above a specific rule can select an unintended translation.
Fortinet’s FortiOS 7.6.2 documentation places central-mode DNAT configuration under Policy & Objects > DNAT & Virtual IPs. UI labels can differ by release. Fortinet: Static virtual IPs, FortiOS 7.6.2
#1 Best Overall
- Next-generation firewall for small office and branch security with NGFW, IPS, and web filtering built in
- Secure SD-WAN improves cloud and SaaS performance while maintaining consistent security policy
- Deep visibility with SSL inspection and application control to identify and govern encrypted traffic
- Simple deployment and centralized management via FortiGate Cloud or FortiManager
- Seamless integration with FortiSwitch and FortiAP for a unified, secure wired and wireless network
Policy NAT and Central NAT compared
| Area | Policy NAT (non-central mode) | Central NAT mode |
|---|---|---|
| Source NAT location | NAT option on an IPv4 firewall policy. | Central SNAT table, configured through central-snat-map; the policy NAT option is skipped when Central NAT is enabled. Fortinet, FortiOS 7.6.6 |
| Destination NAT and VIP relationship | A VIP assigned to a firewall policy must be unassigned before switching to central mode. | DNAT is represented by standalone VIP objects, and a firewall policy still controls whether the resulting flow is allowed. Fortinet, FortiOS 7.0.18 |
| SNAT rule evaluation | Translation is associated with the policy’s NAT setting. | Central rules are evaluated top-down after security policy processing; the first match is applied. Fortinet, FortiOS 7.6.6 |
| Management visibility or change ownership | Not stated in the cited configuration sources. | Not stated in the cited configuration sources. |
Do not assume the mode switch automatically converts every existing policy NAT choice into an equivalent Central SNAT rule. The cited Fortinet documentation explains where to configure NAT, but does not promise automatic conversion.
What can break or behave differently?
Why did my outbound NAT stop working?
If an allowed flow previously relied on the IPv4 policy NAT option, that option is skipped in central mode. Create and verify a Central SNAT rule that matches the intended interfaces, addresses and any protocol or port criteria, and specifies the desired outgoing-interface address or IP pool. The FortiOS 7.4.7 CLI reference documents the Central SNAT map fields and configuration structure. Fortinet: config firewall central-snat-map, FortiOS 7.4.7
Rank #2
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Do I need to remove VIPs from policies first?
Yes, if a VIP is assigned to a firewall policy in non-central mode. Fortinet says that assignment must be removed before switching modes. The VIP object itself can carry over; removing its policy assignment does not mean you should delete the VIP. Fortinet: Central DNAT, FortiOS 7.0.18
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsCould a broad rule select the wrong translation?
Yes. Since central SNAT rules are checked top-down until a match, place narrow rules for specific source, destination, interface, protocol or port combinations above broader rules. Review ordering whenever you add or change a rule, not just during the initial conversion. Fortinet: Central SNAT, FortiOS 7.6.6
Rank #3
- Built on a purposed-built secure processor, this compact network firewall delivers the highest level of security performance and energy efficiency in its class – 2.5 Gbps IPS throughput | 1.3 Gbps threat protection | 1.4 Gbps SSL Inspection throughput.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact design equipped with 10 x GE RJ45 ports (including 7 x Internal Ports, 2 x WAN Ports, 1 x DMZ Port) provide essential connectivity and flexibility for various network configurations in branch offices.
Will explicit source-port mapping work for every protocol?
No. An explicit source-port mapping cannot match a portless protocol such as ICMP. Fortinet also documents a pool-type constraint: explicit mapping with IP pools is limited to Overload pools. Check port-sensitive rules and portless traffic separately rather than assuming they share the same match behavior. Fortinet: Central SNAT, FortiOS 7.6.6
What should I check for inbound VIP traffic?
Follow the entire path: confirm the VIP maps the intended external destination to the correct internal destination, verify routing can reach that translated destination, and confirm a firewall policy permits the resulting flow. FortiManager’s 7.2.6 guide notes that DNAT must occur before routing so the translated destination can be routed. That guide describes FortiManager configuration; verify the corresponding FortiGate behavior and configuration on your own release. Fortinet: Create a new central DNAT or IPv6 central DNAT policy, FortiManager 7.2.6
Rank #4
- Built on a purposed-built secure processor, this compact network firewall delivers the highest level of security performance and energy efficiency in its class – 2.5 Gbps IPS throughput | 1.3 Gbps threat protection | 1.4 Gbps SSL Inspection throughput.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact design equipped with 10 x GE RJ45 ports (including 7 x Internal Ports, 2 x WAN Ports, 1 x DMZ Port) provide essential connectivity and flexibility for various network configurations in branch offices.
Is the switch guaranteed to be hitless?
The cited guides do not establish a universal guarantee for existing session survival, interruption duration or rollback behavior across releases and topologies. Plan the change window and recovery steps for your specific device and environment rather than promising a fixed outage or hitless conversion.
Recommended Free Tools
Order the change to reduce risk
The following is a cautious operational sequence based on the documented mechanics, not a universal Fortinet migration procedure. Confirm device-specific steps against the exact FortiOS build and NAT/NGFW mode.
Best Value
- Extensive Connectivity Options: The FortiGate 60F is designed with 10 GE RJ45 ports, including 2 WAN ports, 1 DMZ port, and 7 internal ports, offering broad flexibility and high-density connections for diverse enterprise networking needs.
- Superior Performance for Secure Networks: Features powerful system-on-a-chip acceleration to deliver top-tier security with 1.4 Gbps IPS throughput and 700 Mbps threat protection throughput, ensuring effective defense against advanced threats.
- Enhanced SSL Inspection and SD-WAN Capabilities: Utilizes purpose-built security processor technology to provide the industry's highest SSL inspection performance and robust SD-WAN functionality for secure, high-speed network operations.
- Simple and Effective Management: Comes equipped with a user-friendly management console that supports comprehensive network automation and visibility, alongside Zero Touch Integration with Fortinet's Security Fabric for streamlined deployment.
- Advanced Security Features: Leverages continuous threat intelligence from AI-powered FortiGuard Labs, identifying and mitigating both known and unknown threats, enhancing security across all network traffic, whether encrypted or not.
- Record the current state. Export or back up the configuration. Inventory IPv4 policies with NAT enabled, IP pools, VIPs, policies referencing VIPs, interfaces, address objects and relevant routes. Record the FortiOS build and current NAT/NGFW mode.
- Translate current SNAT intent into central rules. For each outbound NAT use, document source and destination, ingress and egress interfaces, protocol and ports where applicable, and whether translation should use the outgoing-interface address or an IP pool. Draft the Central SNAT entries before switching. Put specific matches before broad ones because evaluation is top-down. Fortinet: Central SNAT map CLI reference, FortiOS 7.4.7
- Review VIP mappings and permitting policies. Check each inbound mapping alongside the policy that should allow traffic to its translated destination. In non-central mode, unassign VIPs from firewall policies before the switch; retain the VIP objects unless you have a separate reason to remove them. Fortinet: Central DNAT, FortiOS 7.0.18
- Check exception traffic and pool constraints. Identify ICMP and other portless flows, and review rules using explicit source-port mapping. Confirm that any IP pool used with explicit mapping is an Overload pool, as specified in the FortiOS 7.6.6 guide. Fortinet: Central SNAT, FortiOS 7.6.6
- Enable Central SNAT in a controlled window. Fortinet documents enabling it under System > Settings / System Operations Settings and applying the change, or through CLI with
config system settingsfollowed byset central-nat enable. Confirm the exact UI label for your release. Fortinet: Central SNAT, FortiOS 7.6.6 - Validate representative traffic paths. Test outbound traffic using interface NAT and each relevant IP pool; inbound VIP and port-forwarded traffic; traffic that should not be translated; and ICMP or other portless traffic. Verify the selected Central SNAT match, the permitting firewall policy, and routing. Fortinet’s configuration and VIP examples can inform checks, but commands and UI details may vary by release.
- Keep a recovery path ready. Decide in advance how you would disable Central NAT and restore the recorded configuration if validation fails. The cited guides document the enable/disable setting but do not define one rollback sequence or session impact that applies to every release and topology.
When Central NAT is a fit
Central NAT is a change in configuration organization and rule evaluation, not a documented promise of higher speed, greater safety or simpler management. It can make sense when your operating model calls for source NAT to be managed in a central rule table. The key operational trade-off is that administrators must maintain correct central matches and ordering while keeping the security policy responsible for access decisions. The cited sources do not establish comparative management-effort or performance outcomes, so assess those against your own policy set and change process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
