I'm looking for advice on how to best implement a DMZ on a FortiGate firewall (FG-F100), as in the proposed architecture drawing attached diagram.
The goal is to establish a security barrier between each subnetwork (A,B,C,D) but still allow clients on each of these subnets to reach a specific server on the DMZ (Z) network. Only 2 or 3 specific ports will be enabled for TCP communication between each subnet and the Z network server. Traffic from A,B,C,D should never be sent across subnets (i.e., Network A can never talk/broadcast/etc. to Network B)
If possible I'd like to avoid assigning a default gateway to clients on these subnets. If I could somehow have a subnet specific IP that I can tell these nodes to access and have that traffic forwarded to Server_Z1, then re-routed on the way back to the correct subnet.
What would be the best technology for this? NAT, Port Forwarding, or static routes and bite the bullet and assign default gateway?