Home

FortiGate 3600 Installation Guide

1. end To set the external interface to use DHCP enter config system interface edit external set mode dhcp end To set the external interface to use PPPoE enter config system interface edit external set mode pppo set connection enable set username name str set password psswrd end 30 01 28005 0027 20041101 Fortinet Inc NAT Route mode installation Using the command line interface Use the same syntax to set the IP address of each FortiGate interface as required Confirm that the addresses are correct Enter get system interface The CLI lists the IP address netmask and other settings for each of the FortiGate interfaces To configure DNS server settings 1 Set the primary and secondary DNS server IP addresses Enter config system dns set primary address ip set secondary address ip end Example config system dns set primary 293 44 75 21 set secondary 293 44 75 22 end To add a default route Add a default route to configure where the FortiGate unit sends traffic that should be sent to an external network usually the Internet Adding the default route also defines which interface is connected to an external network The default route is not required if the interface connected to the external network is configured using DHCP or PPPoE 1 Set the default route to the Default Gateway IP address Enter config router static edit 1 set dst 0 0 0 0 0 0 0 0 set gateway lt gateway IP gt
2. web based manager 6 connecting to 14 introduction 6 wizard setting up firewall 27 32 38 41 starting 27 33 38 42 01 28005 0027 20041101 53 Index 54 01 28005 0027 20041101 Fortinet Inc
3. xecute restore config filename str You enter xecute restore config myfile bak xxx str indicates an ASCII string that does not contain new lines or carriage returns lt xxx_integer gt indicates an integer string that is a decimal base 10 number lt xxx_octet gt indicates a hexadecimal string that uses the digits 0 9 and letters A F xxx ipv4 indicates a dotted decimal IPv4 address lt xxx_v4mask gt indicates a dotted decimal IPv4 netmask lt xxx_ipv4mask gt indicates a dotted decimal IPv4 address followed by a dotted decimal IPv4 netmask xxx ipv6 indicates a dotted decimal IPv6 address xxx v6mask indicates a dotted decimal IPv6 netmask xxx ipv6mask indicates a dotted decimal IPv6 address followed by a dotted decimal IPv6 netmask FortiGate 3600 Installation Guide 01 28005 0027 20041101 7 Document conventions Introduction Vertical bar and curly brackets to separate alternative mutually exclusive required keywords For example set opmode nat transparent You can enter set opmode nat orset opmode transparent Square brackets to indicate that a keyword or variable is optional For example show system interface lt name_str gt To show the settings for all interfaces you can enter show system interface To show the settings for the internal interface you can enter show system interface internal A space to separate options that can be entered in any combina
4. M Man manman au Manmi ann nan n n MA WALA ent u aaa An WA Son eee AT van mwan A OTO aaa a aa to tanto Aaa vas mean satan man tatonnen vate CRT Iinet POWER aha yal a E E E HiTemp E 4 SHA NT BET E E E E EXTERNAL W Kwake ai Mi Version 2 80 MR5 01 November 2004 01 28005 0027 20041101 Copyright 2004 Fortinet Inc All rights reserved No part of this publication including text examples diagrams or illustrations may be reproduced transmitted or translated in any form or by any means electronic mechanical manual optical or otherwise for any purpose without prior written permission of Fortinet Inc FortiGate 3600 Installation Guide Version 2 80 MR5 01 November 2004 01 28005 0027 20041101 Trademarks Products mentioned in this document are trademarks or registered trademarks of their respective holders Regulatory Compliance FCC Class A Part 15 CSA CUS CAUTION RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTIONS For technical support please visit http www fortinet com Send information about errors or omissions in this document or any Fortinet technical documentation to techdoc fortinet com Table of Contents AE PEYE WA A Sik aa kai on byn ken ki e l a ka n ka kk a n kl n bi a ba on ik kt sa on ka p kaka 5 Secure installation configuration and management ceceeceee
5. set device lt interface gt end Example If the default gateway IP is 204 23 1 2 and this gateway is connected to the external interface config router static edit 1 set dst 0 0 0 0 0 0 0 0 set gateway 204 23 1 2 set devic xternal end FortiGate 3600 Installation Guide 01 28005 0027 20041101 31 Using the setup wizard Using the setup wizard NAT Route mode installation From the web based manager you can use the setup wizard to complete the initial configuration of the FortiGate unit For information about connecting to the web based manager see Connecting to the web based manager on page 14 If you are configuring the FortiGate unit to operate in NAT Route mode the default you can use the setup wizard to add the administration password configure the internal interface address choose either a manual static or a dynamic DHCP or PPPoE address for the external interface add a default route for the external interface add the DNS server IP addresses add the DHCP server settings and IP addresses add various internal server IP addresses including web IMAP POP3 SMTP and FTP servers set the antivirus protection to high medium or none Table 8 lists the additional settings that you can configure with the setup wizard See Table 5 on page 26 and Table 6 on page 26 for other settings Table 8 Setup wizard settings Password Prepare an administrator password Internal Inte
6. starting the cluster interrupts network traffic until the individual FortiGate units in the cluster are functioning and the cluster completes negotiation Cluster negotiation normally takes just a few seconds During system startup and negotiation all network traffic is dropped To connect the cluster 1 Connect the cluster units e Connect the internal interfaces of each FortiGate unit to a switch or hub connected to your internal network e Connect the external interfaces of each FortiGate unit to a switch or hub connected to your external network e Optionally connect ports 1 2 3 and 4 of each FortiGate unit to switches or hubs connected to other networks Connect the 5 HA interfaces of the FortiGate units to another switch or hub FortiGate 3600 Installation Guide 01 28005 0027 20041101 49 Installing and configuring the cluster High availability installation Figure 11 HA network configuration Internal Network Internal External om IS a Hub or Switch em Hs Router Internal External Internet D Power on all the FortiGate units in the cluster As the units start they negotiate to choose the primary cluster unit and the subordinate units This negotiation occurs with no user intervention and normally just takes a few seconds Installing and configuring the cluster 50 When negotiation is complete the you can configure the cluster as if it was a single FortiGate unit e Ifyou are
7. 3600 Installation Guide 01 28005 0027 20041101 33 Connecting the FortiGate unit to the network s NAT Route mode installation There are two copper gigabit ethernet connectors on the FortiGate 3600 unit e Internal for connecting to the internal network e External for connecting to your public switch or router and the Internet There are four fiber optic gigabit ethernet connectors on the FortiGate 3600 unit e 2 3 and 4 for connecting to networks 5 HA to connect to another FortiGate 3600 for high availability see High availability installation on page 45 or to connect to another network JA Note You can also create redundant connections to the Internet by connecting two interfaces to separate Internet connections For example you could connect interface 2 and 3 to different Internet connections each provided by a different service provider To connect the FortiGate 3600 unit running in NAT Route mode 1 Connect the Internal interface to the hub or switch connected to the internal network 2 Connect the External interface to your public switch or router 3 Optionally connect interfaces 1 2 3 4 and 5 HA to networks Figure 9 FortiGate 3600 NAT Route mode connections Other Network Internal Network Sate aroei Teen Switch or Router Port 1 Port 4 FSRTINET WE S I E ForriGere 3600 FortiGate 3600 Port 3 esse Public Switch or Router Internet St 34 01 28005 0027 20041101 Fortinet
8. HTTP FTP IMAP POP3 and SMTP traffic You may not use the strict protection profile under normal circumstances but it is available if you have problems with viruses and require maximum screening Scan To apply antivirus scanning to HTTP FTP IMAP POP3 and SMTP content traffic Quarantine is also selected for all content services On FortiGate models with a hard drive if antivirus scanning finds a virus in a file the file is quarantined on the FortiGate local disk If required system administrators can recover quarantined files FortiGate 3600 Installation Guide 01 28005 0027 20041101 19 Planning the FortiGate configuration Getting started Web To apply antivirus scanning and web content blocking to HTTP content traffic You can add this protection profile to firewall policies that control HTTP traffic Unfiltered To apply no scanning blocking or IPS Use ifyou do not want to apply content protection to content traffic You can add this protection profile to firewall policies for connections between highly trusted or highly secure networks where content does not need to be protected Figure 4 Web protection profile settings Edit Protection Profile Profile Name web w Anti Virus HTTP FTP IMAP POPS SMTP Virus Scan kaa m m m m File Block m LI m Li Li Pass Fragmented Emails lv lv lw Oversized File Email pass gt pass pass pass pass Add signature to outgoing emails l Enable a SMTP only w Web F
9. System gt Status Select Change beside the Operation Mode Select Transparent in the Operation Mode list FortiGate 3600 Installation Guide 01 28005 0027 20041101 41 Connecting the FortiGate unit to your network Transparent mode installation 3 Select OK To reconnect to the web based manager change the IP address of the management computer to 10 10 10 2 Connect to the internal interface and browse to https followed by the Transparent mode management IP address The default FortiGate Transparent mode management IP address is 10 10 10 1 To start the setup wizard Select Easy Setup Wizard the middle button in the upper right corner of the web based manager Use the information that you gathered in Table 9 on page 38 to fill in the wizard fields Select the Next button to step through the wizard pages Confirm your configuration settings and then select Finish and Close Reconnecting to the web based manager If you changed the IP address of the management interface while you were using the setup wizard you must reconnect to the web based manager using the new IP address Browse to https followed by the new IP address of the management interface Otherwise you can reconnect to the web based manager by browsing to https 10 10 10 1 If you connect to the management interface through a router make sure that you have added a default gateway for that router to the management IP default gateway field Connecting the For
10. Virus Time Sre Dst Servi l Web Filter Mo virus detected 4 Spam Filter Log amp Report Sup D pays 23 Hours REAL TIME NETWORK PROTECTION 6 01 28005 0027 20041101 Fortinet Inc Introduction Document conventions Command line interface Setup wizard You can access the FortiGate command line interface CLI by connecting a management computer serial port to the FortiGate RS 232 serial console connector You can also use Telnet or a secure SSH connection to connect to the CLI from any network that is connected to the FortiGate unit including the Internet The CLI supports the same configuration and monitoring functionality as the web based manager In addition you can use the CLI for advanced configuration options that are not available from the web based manager This Installation Guide contains information about basic and advanced CLI commands For a more complete description about connecting to and using the FortiGate CLI see the FortiGate CLI Reference Guide The FortiGate setup wizard provides an easy way to configure the basic initial settings for the FortiGate unit The wizard walks through the configuration of a new administrator password FortiGate interfaces DHCP server settings internal servers web FTP etc and basic antivirus settings Document conventions This guide uses the following conventions to describe command syntax e Angle brackets lt gt to indicate variables For example
11. and select OK to switch the FortiGate unit to Transparent mode Allow the FortiGate unit to restart in Transparent mode and then power off the FortiGate unit Repeat this procedure for all of the FortiGate units in the cluster Once all units are configured continue with Connecting the cluster to your networks on page 49 FortiGate 3600 Installation Guide 01 28005 0027 20041101 47 Configuring FortiGate units for HA operation High availability installation Configuring FortiGate units for HA using the CLI Use the following procedure to configure each FortiGate unit for HA operation To change the FortiGate unit host name 1 Power on the FortiGate unit to be configured 2 Connect to the CLI See Connecting to the command line interface CLI on page 15 3 Change the host name config system global set hostname lt name_str gt end To configure the FortiGate unit for HA operation 1 Configure HA settings Use the following command to Set the HA mode Set the Group ID e Change the unit priority Enable override master e Enter an HA password e Select an active active HA schedule config system ha set mode a a a p standalone set groupid lt id_integer gt set priority lt priority integer gt set override disable enable set password lt password str gt set schedule hub ip ipport leastconnection none random round robin weight round robin end The FortiGate unit negotiates to
12. filtering spam filtering and IPS The factory default firewall configuration is the same in NAT Route and Transparent mode Factory default protection profiles Use protection profiles to apply different protection settings for traffic that is controlled by firewall policies You can use protection profiles to e Configure antivirus protection for HTTP FTP IMAP POP3 and SMTP firewall policies e Configure Web filtering for HTTP firewall policies e Configure Web category filtering for HTTP firewall policies e Configure spam filtering for IMAP POP3 and SMTP firewall policies e Enable the Intrusion Protection System IPS for all services e Enable content logging for HTTP FTP IMAP POP3 and SMTP firewall policies Using protection profiles you can build protection configurations that can be applied to different types of firewall policies This allows you to customize types and levels of protection for different firewall policies For example while traffic between internal and external addresses might need strict protection traffic between trusted internal addresses might need moderate protection You can configure firewall policies for different traffic services to use the same or different protection profiles Protection profiles can be added to NAT Route mode and Transparent mode firewall policies The FortiGate unit comes preconfigured with four protection profiles Strict To apply maximum protection to
13. in NAT Route mode To switch to Transparent mode using the web based manager 1 Go to System gt Status 2 Select Change beside the Operation Mode 3 Select Transparent in the Operation Mode list 4 Select OK To reconnect to the web based manager change the IP address of the management computer to 10 10 10 2 Connect to the internal interface and browse to https followed by the Transparent mode management IP address The default FortiGate Transparent mode management IP address is 10 10 10 1 To change the Management IP 1 Go to System gt Network gt Management 2 Enter the management IP address and netmask that you recorded in Table 9 on page 38 3 Select access methods and logging for any interfaces as required 4 Select Apply 38 01 28005 0027 20041101 Fortinet Inc Transparent mode installation Using the front control buttons and LCD kh OO N 3 To configure DNS server settings Go to System gt Network gt DNS Enter the IP address of the primary DNS server Enter the IP address of the secondary DNS server Select OK To configure the default gateway Go to System gt Network gt Management Set Default Gateway to the default gateway IP address that you recorded in Table 9 on page 38 Select Apply Reconnecting to the web based manager If you changed the IP address of the management interface while you were using the setup wizard you must reconnect to the web based manager using the
14. installing a NAT Route mode cluster use the information in NAT Route mode installation on page 25 to install the cluster on your network e Ifyou are installing a Transparent mode cluster use the information in Transparent mode installation on page 37 to install the cluster on your network The configurations of all of the FortiGate units in the cluster are synchronized so that the FortiGate units can function as a cluster Because of this synchronization you configure and manage the HA cluster instead of managing the individual FortiGate units in the cluster You can configure and manage the cluster by connecting to the cluster web based manager using any cluster interface configured for HTTPS administrative access You can also configure and manage the cluster by connecting to the CLI using any cluster interface configured for SSH administrative access 01 28005 0027 20041101 Fortinet Inc High availability installation Installing and configuring the cluster When you connect to the cluster you are actually connecting to the primary cluster unit The cluster automatically synchronizes all configuration changes to the subordinate units in the cluster as the changes are made The only configuration settings that are not synchronized are the HA configuration except for the interface heartbeat device and monitoring configuration and the FortiGate host name For more information about configuring a cluster see the FortiGate Admi
15. network The default route is not required if the interface connected to the external network is configured using DHCP or PPPoE Go to System gt Router gt Static If the Static Route table contains a default route IP and Mask set to 0 0 0 0 select the Delete icon to delete this route Select Create New Set Destination IP to 0 0 0 0 Set Mask to 0 0 0 0 Set Gateway to the default gateway IP address Set Device to the interface connected to the external network Select OK Using the front control buttons and LCD 28 Basic settings can be configured using the LCD and front control buttons on the FortiGate unit Use IP Address the information that you recorded in Table 5 on 192 168 100 001 page 26 to complete the following procedure Start when Main Menu is displayed on the LCD When you configure interfaces using the control buttons and LCD the interfaces are always named internal external and DMZ The interface names on the LCD correspond as follows to the FortiGate interfaces Table 7 FortiGate 3600 interfaces control buttons and LCD interface name FortiGate 3600 interface name Internal Port Internal External Port External DMZ Port Port 3 Note You cannot configure the external interface for DHCP or PPPoE from the control buttons and LCD Instead you can use the web based manager the CLI or the setup wizard Set the internal interface IP address Use the up and down arrow keys
16. new IP address Browse to https followed by the new IP address of the management interface Otherwise you can reconnect to the web based manager by browsing to https 10 10 10 1 If you connect to the management interface through a router make sure that you have added a default gateway for that router to the management IP default gateway field Using the front control buttons and LCD This procedure describes how to use the control buttons and LCD to configure Transparent mode IP addresses Use the information that you recorded in Table 9 on page 38 to complete this procedure Starting with Main Menu displayed on the LCD use the front control buttons and LCD Press and hold the Esc button until Main Menu appears after four seconds Press Enter three times to configure the management interface IP address Set the manager interface IP address Use the up and down arrow keys to increase or decrease the value of each IP address digit Press Enter to move to the next digit Press Esc to move to the previous digit Note When you enter an IP address the LCD always shows three digits for each part of the address For example the IP address 192 168 100 1 appears on the LCD as 192 168 100 001 The IP address 192 168 23 45 appears as 192 168 023 045 After you set the last digit of the IP address press Enter Use the down arrow to highlight Netmask Press Enter and set the management IP Netmask After you set the last digit of the Netma
17. to increase or decrease the value of each IP address digit Press Enter to move to the next digit Press Esc to move to the previous digit Note When you enter an IP address the LCD always shows three digits for each part of the address For example the IP address 192 168 100 1 appears on the LCD as 192 168 100 001 The IP address 192 168 23 45 appears as 192 168 023 045 01 28005 0027 20041101 Fortinet Inc NAT Route mode installation N oO a fF WO DN ao a fF WO N Using the command line interface After you set the last digit of the IP address press Enter Use the down arrow to highlight Netmask Press Enter and set the internal Netmask After you set the last digit of the Netmask press Enter Press Esc to return to the Main Menu Repeat these steps to configure the external interface and the DMZ interface if required To configure a default gateway The default gateway is usually configured for the external interface You can use the procedure below to configure a default gateway for any interface From the Main Menu press Enter Use the down arrow key to highlight the external interface and press Enter Use the down arrow to highlight Default Gateway Press Enter and set the default gateway After you set the last digit of the default gateway press Enter Press Esc to return to the Main Menu You have now completed the initial configuration of the FortiGate unit and you can proceed to Next steps on p
18. unit for HA operation To change the FortiGate unit host name Changing the host name is optional but you can use host names to identify individual cluster units Power on the FortiGate unit to be configured Connect to the web based manager See Connecting to the web based manager on page 14 Go to System gt Status In the Host Name field of the Unit Information section select Change Type a new host name and select OK To configure a FortiGate unit for HA operation Go to System gt Config gt HA Select High Availability Select the mode Select a Group ID for the HA cluster If required change the Unit Priority If required select Override master Enter and confirm a password for the HA cluster If you are configuring Active Active HA select a schedule Select Apply The FortiGate unit negotiates to establish an HA cluster When you select apply you may temporarily lose connectivity with the FortiGate unit as the negotiation takes place If you are configuring a NAT Route mode cluster power off the FortiGate unit and then repeat this procedure for all the FortiGate units in the cluster Once all of the units are configured continue with Connecting the cluster to your networks on page 49 If you are configuring a Transparent mode cluster reconnect to the web based manager You may have to wait a few minutes before you can reconnect Go to System gt Status Select Change to Transparent Mode
19. 0 Administrative Access HTTPS Ping IP 192 168 100 99 External Interface Netmask 255 255 255 0 Administrative Access Ping IP 0 0 0 0 Port 1 Netmask 0 0 0 0 Administrative Access Ping IP 0 0 0 0 Port 2 Netmask 0 0 0 0 Administrative Access Ping IP 0 0 0 0 Port 3 Netmask 0 0 0 0 Administrative Access Ping IP 0 0 0 0 Port 4 Netmask 0 0 0 0 Administrative Access Ping IP 0 0 0 0 Port 5 HA Netmask 0 0 0 0 Administrative Access Ping FortiGate 3600 Installation Guide 01 28005 0027 20041101 17 Factory default FortiGate configuration settings Getting started Table 2 Factory default NAT Route mode network configuration Continued Default Gateway for default route 192 168 100 1 Interface connected to external network external for default route Default Route A default route consists of a default gateway and the name of Network Settings the interface connected to the external network usually the Internet The default gateway directs all non local traffic to this interface and to the external network Primary DNS Server 207 192 200 1 Secondary DNS Server 207 192 200 129 Factory default Transparent mode network configuration In Transparent mode the FortiGate unit has the default network configuration listed in Table 3 Table 3 Factory default Transparent mode network configuration Administrator User name admin account Password none Miinab
20. 10 10 23 L Transparent mode In Transparent mode the FortiGate unit is invisible to the network Similar to a network bridge all FortiGate interfaces must be on the same subnet You only have to configure a management IP address so that you can make configuration changes The management IP address is also used for antivirus and attack definition updates You typically use the FortiGate unit in Transparent mode on a private network behind an existing firewall or behind a router The FortiGate unit performs firewall functions IPSec VPN virus scanning IPS web content filtering and Spam filtering Figure 7 Example Transparent mode network configuration FortiGate 3600 Unit in Transparent mode Gateway to public network 204 23 1 5 _ 192 168 1 1 Internal network Internet T a ta DA ta mn v EEE lt pannan a 192 168 1 3 S firewall router e ennennne re External 192 168 1 2 Internal Management IP lt a Transparent mode policies controlling traffic between internal and external networks You can connect up to six network segments to the FortiGate unit to control traffic between these network segments e External can connect to the external firewall or router e Internal can connect to the internal network e Port 1 2 3 and 4 can connect to other network segments e Port 5 HA can connect to another network segment Port 5 HA can also connect to other FortiGate 3600s if you are installing an HA cluster 22 01 2
21. 1101 Fortinet Inc RAT MET High availability installation This chapter describes how to install two or more FortiGate units in an HA cluster HA installation involves three basic steps e Configuring FortiGate units for HA operation e Connecting the cluster to your networks e Installing and configuring the cluster For information about HA see the FortiGate Administration Guide and the FortiOS High Availability technical note Priorities of heartbeat device and monitor priorities The procedures in this chapter do not include steps for changing the priorities of heartbeat devices or for configuring monitor priorities settings Both of these HA settings should be configured after the cluster is up and running Configuring FortiGate units for HA operation A FortiGate HA cluster consists of two or more FortiGate units with the same HA configuration This section describes how to configure each of the FortiGate units to be added to a cluster for HA operation The procedures are the same for active active and active passive HA e High availability configuration settings e Configuring FortiGate units for HA using the web based manager e Configuring FortiGate units for HA using the CLI High availability configuration settings Use the following table to select the HA configuration settings for the FortiGate units in the HA cluster Table 10 High availability settings Active Active Load balancing and failover HA Each Forti
22. 8005 0027 20041101 Fortinet Inc Getting started Planning the FortiGate configuration Configuration options Once you have selected Transparent or NAT Route mode operation you can complete the configuration plan and begin to configure the FortiGate unit You can use the web based manager GUI the control buttons and LCD or the command line interface CLI for the basic configuration of the FortiGate unit You can use the web based manager setup wizard for easy configuration of a few more advanced settings Web based manager You can configure most basic and advanced setting from the web based manager GUI CLI If you are configuring the FortiGate unit to operate in NAT Route mode you can add the administration password and all interface addresses using the CLI You can also add DNS server IP addresses and a default route for the external interface If you are configuring the FortiGate unit to operate in Transparent mode you can use the CLI to switch to Transparent mode Then you can add the administration password the management IP address and gateway and the DNS server addresses Front control buttons and LCD If you are configuring the FortiGate unit to operate in NAT Route mode you can use the control buttons and LCD to add the IP address of the FortiGate interfaces as well as the external default gateway If you are configuring the FortiGate unit to operate in Transparent mode you can use the control buttons and LCD to s
23. External is the default interface to the external network usually the Internet e Port 1 is the redundant interface to the external network e Internal is the interface to the internal network e Port 2 is the interface to the DMZ network You must configure routing to support redundant Internet connections Routing can be used to automatically redirect connections from an interface if its connection to the external network fails Otherwise security policy configuration is similar to a NAT Route mode configuration with a single Internet connection You would create NAT mode firewall policies to control traffic flowing between the internal private network and the external public network usually the Internet If you have multiple internal networks such as a DMZ network in addition to the internal private network you could create route mode firewall policies for traffic flowing between them FortiGate 3600 Installation Guide 01 28005 0027 20041101 21 Planning the FortiGate configuration Getting started Figure 6 Example NAT Route multiple internet connection configuration Internal network FortiGate 3600 Unit EE in NAT Route mode ee External 192 168 1 1 i 204 23 1 5 Ze FNE TANT ETI Route mode policies Internet controlling traffic between kale internal networks Port 1 64 83 32 45 e D o Port 3 DMZ network NAT mode policies controlling 10 10 10 2 traffic between internal and f external networks EE 10
24. Fortinet part number CC300248 one gray regular ethernet cable Fortinet part number CC300249 one null modem cable Fortinet part number CC300247 e FortiGate 3600 QuickStart Guide e two power cables e CD containing the FortiGate user documentation FortiGate 3600 Installation Guide 01 28005 0027 20041101 11 Mounting Mounting 12 Getting started Figure 2 FortiGate 3600 package contents Front mn e e A Grey Straight through A g Null Modem Cable RS 232 a LCD Control 1 2 3 4 5 HA Internal External Power Cables 2 Display Buttons Interfaces Interface Interface CO FoRrriSare 3600 Rack Mount Brackets FGATINET Power Fete Supply LEDs Cancel Documentation Redundant RS 232 Serial Button Redundant Hot Swappable Connection Hot Swappable Fan Assemblies Power Supplies The FortiGate 3600 unit can be mounted in a standard 19 inch rack It requires 2 U of vertical space in the rack The FortiGate 3600 unit can also be installed as a free standing appliance on any stable surface Dimensions e 16 75 x 13 5 x 3 5 in 42 7 x 33 x 8 9 cm Weight e 17 5 Ib 8 kg Power requirements e Power dissipation 460 W max e AC input voltage 100 to 240 VAC e AC input current 6 A e Frequency 50 to 60 Hz The FortiGate 1000 unit may overload your supply circuit and impact your overcurrent protection and supply wiring Use appropriate equipment nameplate ratin
25. Gate unit in the HA cluster actively processes connections and monitors the status of the other FortiGate units in the cluster The primary FortiGate unit in the cluster controls load balancing Mode Active Passive Failover HA The primary FortiGate unit in the cluster processes all connections All other FortiGate units in the cluster are passively monitor the cluster status and remain synchronized with the primary FortiGate unit All members of the HA cluster must be set to the same HA mode FortiGate 3600 Installation Guide 01 28005 0027 20041101 45 Configuring FortiGate units for HA operation High availability installation 46 Table 10 High availability settings Continued The group ID range is from 0 to 63 All members of the HA cluster must have the same group ID When the FortiGate units in the cluster are switched to HA mode all of the interfaces of all of the units in the cluster get the same virtual MAC address This virtual MAC address is set according to the group ID Group ID MAC Address 0 00 09 0f 06 ff 00 G ID i ail 00 09 0f 06 ff 01 2 00 09 0f 06 ff 02 63 00 09 0f 06 ff 3f If you have more than one HA cluster on the same network each cluster should have a different group ID If two clusters on the same network have same group ID the duplicate MAC addresses cause addressing conflicts on the network The unit with the highest priority becomes th
26. Inc NAT Route mode installation Configuring the networks Configuring the networks If you are running the FortiGate unit in NAT Route mode the networks must be configured to route all Internet traffic to the IP address of the FortiGate interface to which they are connected If you are using the FortiGate unit as the DHCP server for your internal network configure the computers on your internal network for DHCP Make sure that the connected FortiGate unit is functioning properly by connecting to the Internet from a computer on the internal network You should be able to connect to any Internet address Next steps You can use the following information to configure FortiGate system time to register the FortiGate unit and to configure antivirus and attack definition updates Refer to the FortiGate Administration Guide for complete information on configuring monitoring and maintaining the FortiGate unit To set the date and time For effective scheduling and logging the FortiGate system date and time must be accurate You can either manually set the system date and time or configure the FortiGate unit to automatically keep its time correct by synchronizing with a Network Time Protocol NTP server Go to System gt Config gt Time Select Refresh to display the current FortiGate system date and time Select a Time Zone from the list Optionally select Automatically adjust clock for daylight saving changes check box Select Set T
27. LI Connect the null modem cable to the communications port of your computer and to the FortiGate Console port Make sure that the FortiGate unit is powered on Start HyperTerminal enter a name for the connection and select OK Configure HyperTerminal to connect directly to the communications port on your computer and select OK Select the following port settings and select OK Bits per second 9600 Data bits 8 Parity None Stop bits 1 Flow control None Press Enter to connect to the FortiGate CLI The following prompt is displayed FortiGate 3600 login Type admin and press Enter twice The following prompt is displayed Welcome Type to list available commands For information about how to use the CLI see the FortiGate CLI Reference Guide Factory default FortiGate configuration settings 16 The FortiGate unit is shipped with a factory default configuration The default configuration allows you to connect to and use the FortiGate web based manager to configure the FortiGate unit onto the network To configure the FortiGate unit onto the network you add an administrator password change network interface IP addresses add DNS server IP addresses and configure basic routing if required If you plan to operate the FortiGate unit in Transparent mode you can switch to Transparent mode from the factory default configuration and then configure the FortiGate unit onto the network in Transparent mode Once the network
28. ace Choose from manual DHCP or PPPoE 4 Complete the addressing configuration e For manual addressing enter the IP address and netmask for the interface e For DHCP addressing select DHCP and any required settings e For PPPoE addressing select PPPoE and enter the username and password and any other required settings For information about how to configure these and other interface settings see the FortiGate online help or the FortiGate Administration Guide Select OK Repeat this procedure for each interface amp Note If you change the IP address of the interface you are connecting to you must connect LA through a web browser again using the new address Browse to https followed by the new IP address of the interface If the new IP address of the interface is on a different subnet you may have to change the IP address of your computer to the same subnet To configure DNS server settings Go to System Network DNS Enter the IP address of the primary DNS server Enter the IP address of the secondary DNS server Select OK kh OO N FortiGate 3600 Installation Guide 01 28005 0027 20041101 27 Using the front control buttons and LCD NAT Route mode installation N o N Oo a Rb Q To add a default route Add a default route to configure where the FortiGate unit sends traffic destined for an external network usually the Internet Adding the default route also defines which interface is connected to an external
29. age 35 Using the command line interface You can also configure the FortiGate unit using the command line interface CLI For information about connecting to the CLI see Connecting to the command line interface CLI on page 15 Configuring the FortiGate unit to operate in NAT Route mode Use the information that you gathered in Table 5 on page 26 to complete the following procedures To add change the administrator password Log in to the CLI Change the admin administrator password Enter config system admin edit admin set password lt psswrd gt end FortiGate 3600 Installation Guide 01 28005 0027 20041101 29 Using the command line interface NAT Route mode installation To configure interfaces 1 Log in to the CLI 2 Set the IP address and netmask of the internal interface to the internal IP address and netmask that you recorded in Table 5 on page 26 Enter config system interface edit internal set mode static set ip address ip lt netmask gt end Example config system interface edit internal set mode static set ip lt 192 168 120 99 gt lt 255 255 255 0 gt end 3 Set the IP address and netmask of the external interface to the external IP address and netmask that you recorded in Table 5 on page 26 config system external edit external set mode static set ip address ip netmask end Example config system external edit external set mode static set ip 204 23 1 5 255 255 255 0
30. asaoosososon 27 Contiguring BasiC SOUAMOS woo kika aki ek ke one w s kd up kek edi k paka dok aaa sans kwake sd ekate 27 Using the front control buttons and LOD ccc ceere tere eee eeeeneeeeeeeaeeeeeeteeeeeneea 28 Using the command line interfACB6 Lvvllllrereeeetettarrerooottsssasoootosssasooooosssesooooononenn 29 Configuring the FortiGate unit to operate in NAT Route mode ccceeeeeeeeeeeees 29 Using the setup Wiza d we sci aie tit ee pei va dal seston a ao ti p dan kem eee 32 Starting the setup wizard e bik ri v ka kw kw mann evaded eee n n kn Mk eevee a pk a kk AAA De 33 Reconnecting to the web based manager Lvirlireeeeerrerrrrsesaattesasasnoooonssasaonoonnaaon 33 Connecting the FortiGate unit to the netWork S reeeeerirrreeererereessasooooesssasoanooonasonn 33 COntigurinig TNE n tWONKS e kivweiasanidedtasaskat kis doi ciats akont kodak PO dala n bod ide tan kok E dada nana 35 FortiGate 3600 Installation Guide 01 28005 0027 20041101 Contents Contents NEXT STEPS erer ma kn poud v ia al yn n an a e ot ri n e na n a kk n e a op n a n S ee n 35 Transparent mode installation cccccceeeeeeeeeeeeeeeeeeeeeeeeeneeeeeeeeeeeeeeseeeeeeeeeaes 37 Preparing to configure Transparent mode 0 ceeeceeeeeeeeneeeeeeeeeeaeeeeseeaaeeeeeteeaeeeeenenaaes 37 Using the web based manager ccccccccesescnceneneeseneeeeeeesceaeneeeedecaaetenseseneeeeesee
31. configuration is complete you can perform additional configuration tasks such as setting system time configuring virus and attack definition updates and registering the FortiGate unit 01 28005 0027 20041101 Fortinet Inc Getting started Factory default FortiGate configuration settings The factory default protection profiles can be used to apply different levels of antivirus protection web content filtering spam filtering and IPS to the network traffic that is controlled by firewall policies e Factory default NAT Route mode network configuration e Factory default Transparent mode network configuration e Factory default firewall configuration e Factory default protection profiles Factory default NAT Route mode network configuration When the FortiGate unit is first powered on it is running in NAT Route mode and has the basic network configuration listed in Table 2 This configuration allows you to connect to the FortiGate unit web based manager and establish the configuration required to connect the FortiGate unit to the network In Table 2 HTTPS administrative access means you can connect to the web based manager using HTTPS protocol through this interface Ping administrative access means this interface responds to ping requests Table 2 Factory default NAT Route mode network configuration Administrator User name admin account Password none IP 192 168 1 99 Internal interface Netmask 255 255 255
32. date Center Select Refresh to test the FortiGate unit connectivity with the FortiProtect Distribution Network FDN To be able to connect to the FDN the FortiGate unit default route must point to a network such as the Internet to which a connection to the FDN can be established If FortiProtect Distribution Network changes to Available then the FortiGate unit can connect to the FDN Select Scheduled Update and configure a schedule for receiving antivirus and attack definition updates Select Apply You can also select Update Now to receive the latest virus and attack definition updates For more information about FortiGate settings please see the FortiGate Online Help or the FortiGate Administration Guide 01 28005 0027 20041101 Fortinet Inc RAT MET Transparent mode installation This chapter describes how to install a FortiGate unit in Transparent mode If you want to install the FortiGate unit in NAT Route mode see NAT Route mode installation on page 25 If you want to install two or more FortiGate units in HA mode see High availability installation on page 45 For more information about installing the FortiGate unit in Transparent mode see Planning the FortiGate configuration on page 20 This chapter describes e Preparing to configure Transparent mode e Using the web based manager e Using the front control buttons and LCD e Using the command line interface e Using the setup wizard Connecting
33. e primary unit in the cluster The unit priority range is 0 to 255 The default unit priority is 128 Unit Set the unit priority to a higher value if you want the FortiGate unit to be the primary priority cluster unit Set the unit priority to a lower value if you want the FortiGate unit to be a subordinate unit in the cluster If all units have the same priority the FortiGate unit with the highest serial number becomes the primary cluster unit Override You can configure a FortiGate unit to always become the primary unit in the cluster Master by giving it a high priority and by selecting Override master The schedule controls load balancing among the FortiGate units in the active active HA cluster The schedule must be the same for all units in the cluster None No load balancing Select None when the cluster interfaces are connected to load balancing switches Hub Load balancing for hubs Select Hub if the cluster interfaces are connected to a hub Traffic is distributed to units in a cluster based on the Source IP and Destination IP of the packet Least Least connection load balancing If the FortiGate units are Connection connected using switches select Least connection to distribute traffic to the cluster unit with the fewest concurrent connections Round Robin Round robin load balancing If the FortiGate units are connected using switches select round robin to distribute traffic to the next available cluster unit Weighted We
34. e system time to register the FortiGate unit and to configure antivirus and attack definition updates Next steps Refer to the FortiGate Administration Guide for complete information on configuring monitoring and maintaining your FortiGate unit To set the date and time For effective scheduling and logging the FortiGate system date and time must be accurate You can either manually set the system date and time or configure the FortiGate unit to automatically keep its time correct by synchronizing with a Network Time Protocol NTP server Go to System gt Config gt Time Select Refresh to display the current FortiGate system date and time Select your Time Zone from the list Optionally select Automatically adjust clock for daylight saving changes check box Select Set Time and set the FortiGate system date and time Set the hour minute second month day and year as required Nn oO oO FR WO ND Select Apply FortiGate 3600 Installation Guide 01 28005 0027 20041101 43 Next steps 44 Transparent mode installation To use NTP to set the FortiGate date and time Go to System Config Time Select Synchronize with NTP Server to configure the FortiGate unit to use NTP to automatically set the system time and date Enter the IP address or domain name of the NTP server that the FortiGate unit can use to set its time and date Specify how often the FortiGate unit should synchronize its time with the NTP serv
35. eeeeeeeeeeeeeeceeaeeaeeees 6 Web based Manager ceceeceeeeeeee eee eeteee eee eiieee eee tienes eee tieeeeeeeniaeeeeeeseeeeseneeeeenenea 6 Command ling interface 220 tects eye de kek na vese a wan RE 7 Setup Wizard v eka edit de ket nn kk kek ka ek a aa Gid dana svadelanaegudadiestendedeceasanedddunnapnaddedeanabedeans 7 DOCUMENT CONVENTIONS eresi voila ai tk kil aa tk ou LER kaa k a oo eds ended die di e Gita a d 7 FONIN t AOCUMENtAU ON ik bal kaa p tt an n kab di a ed St A sued dak a TA A ko Sa ankd anan a besoin 9 Comments on Fortinet technical documentation c ccceecceeeeeeeeeteeeeeeettteeeeeeenaeeeeeeeea 9 Customer service and technical SUPPOSt ccceceeceeeeceeeeeeeeeeeccecaeceeeeeeeeeseeeeesennanaeeees 10 KWIS TA 1 ap kk kk n ik poban na n kk n n iadaaa eee kk ee koyo ek kk 11 PACKAGE COMtENIS wi ic vive iavi on ke koke ouka pi ele kk l a kk ak da MO kk AN cal ni KE teeta 11 MOUNA ie dak nn kn ti kn pa kin n ik n beh ka a a n an n a tiated Aaa ke A kek men k a apab n 12 Turning the FortiGate unit power on and Off 00 0 2 cece eee teeeee eee teeeeeeeeeteeeeaeeeeeeeenaaees 13 Connecting to the web based Manager cccceeeeeteeeeeeeeeeeeeseeeeeeeeteeeeeeeeteeaaeeeseeenaneees 14 Connecting to the command line interface CLI Lirrrrolrrerrerorrrevortrtttasenooonsasoooooonoe 15 Factory default FortiGate configuration settings Lvirr erererrrrorreeerrorrsasoooooossasooo
36. eeeeeseeeeeeeeeeeeeeeeeeeteeeaaeeeeeeeaeeees 49 Installing and configuring the CIUStET 0 vvlllltlevvettttaa re aanttasaseoot sseatooooosssesoonoonsasonn 50 MAOK cz s k pk kk kk pp FDA AAS A ADA RA AA AS AAA AA kk bib ADA ASA DESA AAA AS A ASAA HA SA kek AES SESSIE IREA bik 53 4 01 28005 0027 20041101 Fortinet Inc AT MET Introduction FortiGate Antivirus Firewalls improve network security reduce network misuse and abuse and help you use communications resources more efficiently without compromising the performance of your network FortiGate Antivirus Firewalls are ICSA certified for firewall IPSec and antivirus services The FortiGate Antivirus Firewall is a dedicated easily managed security device that delivers a full suite of capabilities that include e application level services such as virus protection and content filtering e network level services such as firewall intrusion detection VPN and traffic shaping The FortiGate Antivirus Firewall uses Fortinet s Accelerated Behavior and Content Analysis System ABACAS technology which leverages breakthroughs in chip design networking security and content analysis The unique ASIC based architecture analyzes content and behavior in real time enabling key applications to be deployed right at the network edge where they are most effective at protecting your networks The FortiGate 3600 model provides the carrier class levels of performance and reliabili
37. enieatiP IP 10 10 10 1 Netmask 255 255 255 0 DNS Primary DNS Server 207 194 200 1 Secondary DNS Server 207 194 200 129 Internal HTTPS Ping External Ping Port 1 Ping Administrative access Port 2 Ping Port 3 Ping Port 4 Ping Port 5 HA Ping Factory default firewall configuration FortiGate firewall policies control how all traffic is processed by the FortiGate unit Until firewall policies are added no traffic can be accepted by or pass through the FortiGate unit To allow traffic through the FortiGate unit you can add firewall policies See the FortiGate Administration Guide for information about adding firewall policies The following firewall configuration settings are included in the default firewall configuration to make it easier to add firewall policies 18 01 28005 0027 20041101 Fortinet Inc Getting started Factory default FortiGate configuration settings Table 4 Default firewall configuration Configuration setting Name Description Firewall address All Firewall address matches the source or destination address of any packet Pre defined service More than 50 Select from any of the 50 pre defined services predefined services to control traffic through the FortiGate unit that uses that service Recurring schedule Always The recurring schedule is valid at any time Protection Profiles Strict Scan Web Control how the FortiGate unit applies virus Unfiltered scanning web content
38. er Select Apply To register your FortiGate unit After purchasing and installing a new FortiGate unit you can register the unit by going to the System Update Support page or using a web browser to connect to http support fortinet com and selecting Product Registration To register enter your contact information and the serial numbers of the FortiGate units that you or your organization have purchased You can register multiple FortiGate units in a single session without re entering your contact information To configure virus and attack definition updates You can configure the FortiGate unit to automatically receive new versions of the virus and attack definitions on a schedule through the web based manager You can also receive updates whenever a threat occurs by using Push Updates Go to System Maintenance Update Center Select Refresh to test the FortiGate unit connectivity with the FortiProtect Distribution Network FDN To be able to connect to the FDN the FortiGate unit default route must point to a network such as the Internet to which a connection to the FDN can be established If FortiProtect Distribution Network changes to Available then the FortiGate unit can connect to the FDN Select Scheduled Update and configure a schedule for receiving antivirus and attack definition updates Select Apply You can also select Update Now to receive the latest virus and attack definition updates 01 28005 0027 2004
39. er to include the s in https The FortiGate login is displayed 4 Type admin in the Name field and select Login The Register Now window is displayed It is important to register the Fortigate unit so that Fortinet can contact the unit for firmware updates You must register to receive updates to the FortiGate antivirus and attack definitions Figure 3 Example FortiGate login ForRtricere 3000 WEB CONFIG f system Router l firewal l User Even f ps ENTS FortiGate s 3600 z li web Fiter Name Mw ron 8 Spam Fitter Log amp Report Password Coi Bue 0 Days ZO Hours REAL TIME NETWORK PROTECTION Connecting to the command line interface CLI As an alternative to the web based manager you can install and configure the FortiGate unit using the CLI Configuration changes made with the CLI are effective immediately without resetting the firewall or interrupting service To connect to the FortiGate CLI you need a computer with an available communications port e the null modem cable included in your FortiGate package e terminal emulation software such as HyperTerminal for Windows FortiGate 3600 Installation Guide 01 28005 0027 20041101 15 A on Factory default FortiGate configuration settings Getting started Note The following procedure describes how to connect to the CLI using Windows HyperTerminal software You can use any terminal emulation program To connect to the C
40. establish an HA cluster 2 If you are configuring a NAT Route mode cluster power off the FortiGate unit and then repeat this procedure for all the FortiGate units in the cluster Once all of the units are configured continue with Connecting the cluster to your networks on page 49 3 If you are configuring a Transparent mode cluster switch the FortiGate unit to Transparent mode config system global set opmode transparent end 4 Allow the FortiGate unit to restart in Transparent mode and then power off the FortiGate unit 5 Repeat this procedure for all of the FortiGate units in the cluster then continue with Connecting the cluster to your networks on page 49 48 01 28005 0027 20041101 Fortinet Inc High availability installation Connecting the cluster to your networks Connecting the cluster to your networks Use the following procedure to connect a cluster operating in NAT Route mode or Transparent mode Connect the FortiGate units in the cluster to each other and to your network You must connect all matching interfaces in the cluster to the same hub or switch Then you must connect these interfaces to their networks using the same hub or switch Fortinet recommends using switches for all cluster connections for the best performance Inserting an HA cluster into your network temporarily interrupts communications on the network because new physical connections are being made to route traffic through the cluster Also
41. gs to address this concern e Make sure that the FortiGate 1000 unit has reliable earthing Fortinet recommends direct connections to the branch circuit 01 28005 0027 20041101 Fortinet Inc Getting started Turning the FortiGate unit power on and off Environmental specifications e Operating temperature 32 to 104 F 0 to 40 C e Storage temperature 13 to 158 F 25 to 70 C e Humidity 5 to 95 non condensing e If you install the FortiGate 3600 unit in a closed or multi unit rack assembly the operating ambient temperature of the rack environment may be greater than room ambient Make sure the operating ambient temperature does not exceed the manufacturer s maximum rated ambient temperature Air flow e For rack installation make sure that the amount of air flow required for safe operation of the FortiGate unit is not compromised e For free standing installation make sure that the FortiGate unit has at least 1 5 in 3 75 cm of clearance on each side to allow for adequate air flow and cooling Mechanical loading e For rack installation make sure the mechanical loading of the FortiGate unit is evenly distributed to avoid a hazardous condition Turning the FortiGate unit power on and off To power on the FortiGate unit 1 Connect the power cables to the power connections on the back of the FortiGate unit 2 Connect the power cables to power outlets Connect each power cable to a different power source if possible If
42. hange your registration information at any time Fortinet email support is available from the following addresses amer_support fortinet com For customers in the United States Canada Mexico Latin America and South America apac_support fortinet com For customers in Japan Korea China Hong Kong Singapore Malaysia all other Asian countries and Australia eu_support fortinet com For customers in the United Kingdom Scandinavia Mainland Europe Africa and the Middle East For information on Fortinet telephone support see http support fortinet com When requesting technical support please provide the following information Your name Company name Location Email address Telephone number FortiGate unit serial number FortiGate model FortiGate FortiOS firmware version Detailed description of the problem 01 28005 0027 20041101 Fortinet Inc RAT MET Getting started This section describes unpacking setting up and powering on a FortiGate Antivirus Firewall unit This section includes e Package contents e Mounting e Turning the FortiGate unit power on and off e Connecting to the web based manager e Connecting to the command line interface CLI e Factory default FortiGate configuration settings e Planning the FortiGate configuration e Next steps Package contents The FortiGate 3600 package contains the following items e FortiGate 3600 Antivirus Firewall one red crossover ethernet cable
43. ighted round robin load balancing Similar to round robin but Sch dul Round Robin Weighted values are assigned to each of the units in a cluster chedule based on their capacity and on how many connections they are currently processing For example the primary unit should have a lower weighted value because it handles scheduling and forwards traffic Weighted round robin distributes traffic more evenly because units that are not processing traffic will be more likely to receive new connections than units that are very busy Random Random load balancing If the FortiGate units are connected using switches select random to randomly distribute traffic to cluster units IP Load balancing according to IP address If the FortiGate units are connected using switches select IP to distribute traffic to units in a cluster based on the Source IP and Destination IP of the packet IP Port Load balancing according to IP address and port If the FortiGate units are connected using switches select IP Port to distribute traffic to units in a cluster based on the Source IP Source Port Destination IP and Destination port of the packet 01 28005 0027 20041101 Fortinet Inc High availability installation Configuring FortiGate units for HA operation Configuring FortiGate units for HA using the web based manager oOoON Oa Fk WO DY 10 11 12 13 14 15 16 Use the following procedure to configure each FortiGate
44. iltering maaa v web Content Block Web URL Block Web Exempt List Web Script Filter Planning the FortiGate configuration 20 Before you configure the FortiGate unit you need to plan how to integrate the unit into the network Among other things you must decide whether you want the unit to be visible to the network which firewall functions you want it to provide and how you want it to control the traffic flowing between its interfaces Your configuration plan depends on the operating mode that you select The FortiGate unit can be configured in one of two modes NAT Route mode the default or Transparent mode NAT Route mode In NAT Route mode the FortiGate unit is visible to the network Like a router all its interfaces are on different subnets The following interfaces are available in NAT Route mode e External is the interface to the external network usually the Internet e Internal is the interface to the internal network e Ports 1 3 and 4 can be connected to any networks e Port 2 can be connected to a DMZ network or to any other network e Port 5 HA can be connected to another network Port 5 HA can also be connected to other FortiGate 3600s if you are installing an HA cluster 01 28005 0027 20041101 Fortinet Inc Getting started Planning the FortiGate configuration You can add firewall policies to control whether communications through the FortiGate unit operate in NAT or Route mode Firewall p
45. ime and set the FortiGate system date and time Set the hour minute second month day and year as required N oO oO fF WN Select Apply To use NTP to set the FortiGate date and time 1 Go to System gt Config gt Time 2 Select Synchronize with NTP Server to configure the FortiGate unit to use NTP to automatically set the system time and date 3 Enter the IP address or domain name of the NTP server that the FortiGate unit can use to set its time and date Specify how often the FortiGate unit should synchronize its time with the NTP server Select Apply FortiGate 3600 Installation Guide 01 28005 0027 20041101 35 Next steps 36 NAT Route mode installation To register the FortiGate unit After purchasing and installing a new FortiGate unit you can register the unit by going to the System Update Support page or using a web browser to connect to http support fortinet com and selecting Product Registration To register enter your contact information and the serial numbers of the FortiGate units that you or your organization have purchased You can register multiple FortiGate units in a single session without re entering your contact information To configure virus and attack definition updates Go to the FortiGate web based manager Update Center to configure the FortiGate unit to automatically receive new versions of the virus definitions and attack definitions are available Go to System gt Maintenance gt Up
46. nistration Guide FortiGate 3600 Installation Guide 01 28005 0027 20041101 51 Installing and configuring the cluster High availability installation 52 01 28005 0027 20041101 Fortinet Inc Index Cc CLI 7 configuring IP addresses 40 configuring NAT Route mode 29 connecting to 15 cluster connecting 49 50 command line interface 7 connect cluster 49 50 connecting to network 33 42 web based manager 14 customer service 10 D default gateway configuring Transparent mode 41 E environmental specifications 13 F firewall setup wizard 6 27 32 38 41 starting 27 33 38 42 Fortinet customer service 10 front keypad and LCD configuring IP address 39 H HA configuring FortiGate units for HA operation 45 connecting an HA cluster 49 50 High availability 45 HTTPS 6 internal network configuring 35 IP addresses configuring from the CLI 40 configuring with front keypad and LCD 28 39 FortiGate 3600 Installation Guide RAT MET L LCD and keypad configuring IP address 28 management IP address transparent mode 40 N NAT Route mode configuration from the CLI 29 NTP 35 43 NTP server 35 44 P power requirements 12 powering on 13 S set time 35 43 setup wizard 27 32 38 41 starting 27 33 38 42 synchronize with NTP server 35 44 T technical support 10 time zone 35 43 Transparent mode changing to 40 configuring the default gateway 41 management IP address 40 W
47. nit Always shut down the FortiGate operating system properly before turning off the power switch From the web based manager go to System gt Maintenance gt ShutDown select Shut Down and select Apply or from the CLI enter execute shutdown Disconnect the power cables from the power supply Connecting to the web based manager 14 ye Use the following procedure to connect to the web based manager for the first time Configuration changes made with the web based manager are effective immediately without resetting the firewall or interrupting service To connect to the web based manager you need e acomputer with an ethernet connection e Internet Explorer version 4 0 or higher e a crossover cable or an ethernet hub and two ethernet cables Note You can use the web based manager with recent versions of most popular web on browsers The web based manager is fully supported for Internet Explorer version 4 0 or higher 01 28005 0027 20041101 Fortinet Inc Getting started Connecting to the command line interface CLI To connect to the web based manager 1 Set the IP address of the computer with an ethernet connection to the static IP address 192 168 1 2 with a netmask of 255 255 255 0 2 Using the crossover cable or the ethernet hub and cables connect the internal interface of the FortiGate unit to the computer ethernet connection 3 Start Internet Explorer and browse to the address https 192 168 1 99 rememb
48. nnaeneneeeane 38 Reconnecting to the web based manager cceceeceeeeeeeeeeeeeeenneeeeeeeeaeeeeeeetaeeeeenenaas 39 Using the front control buttons and LCD cceceeeeeeeeeeeeeeeeeeeeeeeeeeeeaeeeetenaaeeeeeeenaeees 39 Using the command line interface cece etter eee etnneee eee tiaeeeeeeeaeeeeeetiaeeeeeesiaeeeeeee 40 Using the setup WIZANQ rcs aw si ake mea ake ab an ke ka pected at ental pa od ok ae kk pk kwa Pak eee 41 Reconnecting to the web based manager Lvrr rreeeeerrerrrtsaarottesasasaonoosssasaanoonnaaon 42 Connecting the FortiGate unit to your network Lillllieeeereertreeesarerteesasasonesssasoanoonsasonn 42 NEXU SLOPS w tid add say sok ks dedtan pos dila sp saa av A tak kos ess LE pon sida kanna si see E sos dako nas S TI 43 High availability installation ccc e eee e ee eeeeeeeeeeeeeeeeeeeeneneeeeeeeeeeeeeeeeeenenes 45 Priorities of heartbeat device and monitor priorities cccecceececeeeeeeeeeeeeeteeeneees 45 Configuring FortiGate units for HA operation cece centre eee eeeneeeeee tennessee tinaeeeeeeee 45 High availability configuration settings 0 ccc ceeeeeeeeeeeeeneeeeeeeeaaeeeeeeeaeeeeeeeeaeeeeeneeaas 45 Configuring FortiGate units for HA using the web based manager v eeeeeeeees 47 Configuring FortiGate units for HA using the CLI eeceeeeeeeettteeeeeeeeneeeeeeeeaaes 48 Connecting the cluster to your NEtWOFKS cccceeeeeeeeeeeen
49. ntivirus protection web content filtering and spam filtering to traffic passing through the FortiGate unit FortiGate CLI Reference Guide Describes how to use the FortiGate CLI and contains a reference to all FortiGate CLI commands FortiGate Log Message Reference Guide Describes the structure of FortiGate log messages and provides information on all log messages generated by the FortiGate unit FortiGate High Availability Guide Contains in depth information about FortiGate High Availability and the FortiGate Clustering Protocol FGCP The FortiGate online help also contains procedures for using the FortiGate web based manager to configure and manage the FortiGate unit For a complete list of FortiGate documentation visit Fortinet Technical Support at http support fortinet com Comments on Fortinet technical documentation You can send information about errors or omissions in this document or any Fortinet technical documentation to techdoc fortinet com FortiGate 3600 Installation Guide 01 28005 0027 20041101 9 Customer service and technical support Introduction Customer service and technical support 10 For antivirus and attack definition updates firmware updates updated product documentation technical support information and other resources please visit the Fortinet technical support web site at http support fortinet com You can also register FortiGate Antivirus Firewalls from http support fortinet com and c
50. olicies control the flow of traffic based on the source address destination address and service of each packet In NAT mode the FortiGate unit performs network address translation before it sends the packet to the destination network In Route mode there is no address translation You typically use NAT Route mode when the FortiGate unit is operating as a gateway between private and public networks In this configuration you would create NAT mode firewall policies to control traffic flowing between the internal private network and the external public network usually the Internet If you have multiple internal networks such as a DMZ network in addition to the internal private network you could create route mode firewall policies for traffic flowing between them Figure 5 Example NAT Route mode network configuration Internal network FortiGate 3600 Unit ae 192 168 1 3 in NAT Route mode Internal 192 168 1 1 External PERTINET 204 23 1 5 G IITTI n Route mode policies controlling traffic between internal networks Internet Ss Port 3 DMZ network 10 10 10 2 NAT mode policies controlling traffic between internal and external networks emo F 10 10 10 23 NAT Route mode with multiple external network connections In NAT Route mode you can configure the FortiGate unit with multiple redundant connections to the external network usually the Internet For example you could create the following configuration e
51. omplete text based interface for configuring all settings See Using the command line interface on page 29 e the setup wizard provides easy fast configuration of the most basic settings to get the unit up and running quickly See Using the setup wizard on page 32 The method that you choose depends on the complexity of the configuration access and equipment and the type of interface you are most comfortable using FortiGate 3600 Installation Guide 01 28005 0027 20041101 25 Preparing to configure the FortiGate unit in NAT Route mode NAT Route mode installation Table 5 NAT Route mode settings Administrator Password IP Internal Netmask External Port 1 Port 2 Netmask IP Port 3 Netmask IP Port 4 Netmask IP Port 5 HA Netmask Default Gateway Interface connected to external network usually external A default route consists of a default gateway and the name of the interface connected to the external network usually the Internet The default gateway directs all non local traffic to this interface and to the external network Network settings Primary DNS Server Secondary DNS Server DHCP or PPPoE configuration You can configure any FortiGate interface to acquire its IP address from a DHCP or PPPoE server Your ISP may provide IP addresses using one of these pr
52. one power source fails the other source might still be operative A Note If only one power supply is connected an audible alarm sounds to indicate a failed power c supply To stop this alarm press the red alarm cancel button on the rear panel next to the power gt supplies After a few seconds SYSTEM STARTING appears on the LCD SYSTEM STARTING gt gt gt gt gt MAIN MENU appears on the LCD when the system is running FortiGate 3600 Installation Guide 01 28005 0027 20041101 13 Connecting to the web based manager Getting started Table 1 FortiGate 3600 LED indicators LED State Description Power Green The FortiGate unit is powered on Off The FortiGate unit is powered off 1 2 3 4 Green The correct cable is in use and the connected equipment has 5 HA INT EXT power left side of Flashing Network activity at this interface faceplate green Off No link established 1 Green The correct cable is in use and the connected equipment has 10 100 power interface Flashing Network activity at this interface green Green The interface is connected at 100 Mbps Off No link established Internal Amber The correct cable is in use and the connected equipment has External power gigabit copper Flashing Network activity at this interface interfaces amber Green The interface is connected at 1000 Mbps Off No link established To power off the FortiGate u
53. onfig system manageip set ip 10 10 10 2 255 255 255 0 end Confirm that the address is correct Enter get system manageip The CLI lists the management IP address and netmask 01 28005 0027 20041101 Fortinet Inc Transparent mode installation Using the setup wizard To configure DNS server settings 1 Set the primary and secondary DNS server IP addresses Enter config system dns set primary address ip set secondary address ip end Example config system dns set primary 293 44 75 21 set secondary 293 44 75 22 end To configure the default gateway 1 Make sure that you are logged into the CLI 2 Set the default route to the default gateway that you recorded in Table 9 on page 38 Enter config router static edit 1 set dst 0 0 0 0 0 0 0 0 set gateway address gateway gt set device lt interface gt end Example If the default gateway IP is 204 23 1 2 and this gateway is connected to port2 config router static edit 1 set dst 0 0 0 0 0 0 0 0 set gateway 204 23 1 2 set device port2 end Using the setup wizard From the web based manager you can use the setup wizard to begin the initial configuration of the FortiGate unit For information about connecting to the web based manager see Connecting to the web based manager on page 14 The first time you connect to the FortiGate unit it is configured to run in NAT Route mode To switch to Transparent mode using the web based manager 1 Go to
54. oonsean 16 Factory default NAT Route mode network Configuration vwrrrrrrrreerrrrresesanoooonnaann 17 Factory default Transparent mode network configuration c ceeeeseeeeeeeeeteeeeeeeees 18 Factory default firewall Configuration cccceeeeeeeceeeeeeeeneeeeeeeecieeeeeetaeeeeeetneeeeeeeea 18 Factory default protection profiles ccccecceceeeeeeeeeceecaecaeeeeeeeeeeesecenceucnaneeeeeeeereees 19 Planning the FortiGate Configuration 0 cecceceeeeeenneeeeeeeenneeeeeeeecaeeeeeesaeeeeeeenaeeeeeeeaas 20 NAT Route MOdG icisieteiaisieed ana e terin noise wo na ie e ka ieee e kaa kk e ewa bek RE kasek aki kaka ana ke 20 NAT Route mode with multiple external network connections ccccceeeeeeeeeeeteees 21 Transparent MOUL isk bik daaa iia ia aaia a 22 CONMQUPATION OPTIONS tv si aaa good ena i araa ai ab idea bek da oo bo dane devi awa ba pe baze 23 Next stepS ceceeceeeccececee cee ee tate aaa aa aaa aa ee cent ea caaaaaaaaeaeceeeeeeeeeegesageeeeeeaneeeeeeeeeeeeeseeeeees 24 NAT Route mode installation ccccccseesseeceeeeeeeeeeeeeeeeeeeeeseeeaeeeeeeeseeeeeeeeeeeeeeees 25 Preparing to configure the FortiGate unit in NAT Route mode seeeeeeeeeeeeeeeees 25 DHCP or PPPOE Configuration o ietcci cs ccteancesteeeiecedieaeeenteeecidisvedadtaeeiineedavvcetesviens 26 Using the web based manager Lvvlllolieeevoteottte a aeoaootataaeooootasaaaoooososasaoososos
55. otocols To use the FortiGate DHCP server you need to configure an IP address range and default route for the server No configuration information is required for interfaces that are configured to use DHCP PPPoE requires you to supply a user name and password In addition PPPoE unnumbered configurations require you to supply an IP address Use Table 2 to record the information you require for your PPPoE configuration Table 6 PPPoE settings User name Password 26 01 28005 0027 20041101 Fortinet Inc NAT Route mode installation Using the web based manager Using the web based manager You can use the web based manager for the initial configuration of the FortiGate unit You can also continue to use the web based manager for all FortiGate unit settings For information about connecting to the web based manager see Connecting to the web based manager on page 14 Configuring basic settings After connecting to the web based manager you can use the following procedures to complete the basic configuration of the FortiGate unit To add change the administrator password Go to System gt Admin gt Administrators Select the Change Password icon for the admin administrator Enter the new password and enter it again to confirm Select OK kh OO N To configure interfaces Go to System gt Network gt Interface Select the edit icon for an interface Set the addressing mode for the interf
56. rface Use the information you gathered in Table 5 on page 26 External Interface Use the information you gathered in Table 5 on page 26 DHCP server Starting IP Ending IP Netmask Default Gateway DNS IP Your FortiGate firewall contains a DHCP server to automatically set up the addresses of computers on your internal network Internal servers Web Server SMTP Server POP3 Server IMAP Server FTP Server If you provide access from the Internet to a web server SMTP server POP3 server IMAP server or FTP server installed on an internal network add the IP addresses of the servers here 32 01 28005 0027 20041101 Fortinet Inc NAT Route mode installation Connecting the FortiGate unit to the network s Table 8 Setup wizard settings High Create a protection profile that enables virus scanning file blocking and blocking of oversize email for HTTP FTP IMAP POP3 and SMTP Add this protection profile to a default firewall policy w Medium Create a protection profile that enables virus Antivirus scanning for HTTP FTP IMAP POP3 and SMTP recommended Add this protection profile to a default firewall policy None Do not configure antivirus protection Select one of these security levels to protect your network from viruses Starting the setup wizard 1 l In
57. sk press Enter Press Esc to return to the Main Menu Repeat these steps to configure the default gateway if required FortiGate 3600 Installation Guide 01 28005 0027 20041101 39 Using the command line interface Transparent mode installation Using the command line interface 40 As an alternative to the web based manager or setup wizard you can begin the initial configuration of the FortiGate unit using the command line interface CLI To connect to the CLI see Connecting to the command line interface CLI on page 15 Use the information that you gathered in Table 9 on page 38 to complete the following procedures To change to Transparent mode using the CLI Make sure that you are logged into the CLI Switch to Transparent mode Enter config system global set opmode transparent end The FortiGate unit restarts After a few seconds the login prompt appears Type admin and press Enter The following prompt appears Welcome Confirm that the FortiGate unit has switched to Transparent mode Enter get system status The CLI displays the status of the FortiGate unit including the following line of text Operation mode Transparent To configure the management IP address Make sure that you are logged into the CLI Set the management IP address and netmask to the IP address and netmask that you recorded in Table 9 on page 38 Enter config system manageip set ip address ip netmask end Example c
58. supports multiple languages You can configure the FortiGate unit for HTTP and HTTPS administration from any FortiGate interface You can use the web based manager to configure most FortiGate settings You can also use the web based manager to monitor the status of the FortiGate unit Configuration changes made using the web based manager are effective immediately without resetting the firewall or interrupting service Once you are satisfied with a configuration you can download and save it The saved configuration can be restored at any time Figure 1 Example of the FortiGate web based manager login FORTIGATE WEB CONFIG Status Session Autamatic Refresh Intar Toons 1 AN ortinet Firauall Satup Wizard Microsoft Internet Explorer System Status UP Time O day s 23 kouri Sisto eee Tua May 22 2212015 Man Set The Administration Password Log Disk Not available terfa For security reasons you should enter a password far the 1102 Feat kan beke cera Make sure that it is difficult for others N Router Host Name Fortigate 100 chan D Firmvrore Version Fortigate 100 2 00 t ANN Tha password can contain numbers 0 9 and uppercase T Firewan Antvimue 4 321 03 07 2004 and lowercase letters A 2 a z but no spaces Definitions q User Attack Definitione 2 10 4 05 05 2004 3 FGT100280302 ke la di A Rey Serial Number F T10029 0902 Change password Operation Mode NAT Change nation J irs Recent Virus Detections Anti
59. the FortiGate unit to your network e Next steps Preparing to configure Transparent mode Use Table 9 to gather the information that you need to customize Transparent mode settings You can configure Transparent mode using four methods e the web based manager GUI e front control buttons and LCD command line interface CLI e setup wizard The method you choose depends on the complexity of the configuration access and equipment and the type of interface you are most comfortable using FortiGate 3600 Installation Guide 01 28005 0027 20041101 37 Using the web based manager Transparent mode installation Table 9 Transparent mode settings Administrator Password IP Netmask Default Gateway Management IP The management IP address and netmask must be valid for the network from which you will manage the FortiGate unit Add a default gateway if the FortiGate unit must connect to a router to reach the management computer Primary DNS Server DNS Settings Secondary DNS Server Using the web based manager You can use the web based manager to complete the initial configuration of the FortiGate unit You can continue to use the web based manager for all FortiGate unit settings For information about connecting to the web based manager see Connecting to the web based manager on page 14 The first time you connect to the FortiGate unit it is configured to run
60. the web based manager select Easy Setup Wizard Figure 8 Select the Easy Setup Wizard Follow the instructions on the wizard pages and use the information that you gathered in Table 5 on page 26 and Table 8 on page 32 to fill in the wizard fields Select the Next button to step through the wizard pages Confirm the configuration settings and then select Finish and Close Note If you use the setup wizard to configure internal server settings the FortiGate unit adds port forwarding virtual IPs and firewall policies for each server For example for each server located on the Internal network the FortiGate unit adds an External gt Internal firewall policy Reconnecting to the web based manager If you changed the IP address of the internal interface while you were using the setup wizard you must reconnect to the web based manager using the new IP address Browse to https followed by the new IP address of the internal interface The default address of the internal interface is https 192 168 1 99 You are now finished the initial configuration of the FortiGate unit and can proceed to Next steps on page 35 Connecting the FortiGate unit to the network s After you complete the initial configuration you can connect the FortiGate 3600 unit between the internal network and the Internet There is one 10 100Base TX interface interface 1 on the FortiGate 3600 unit that can be connected to a 10 100 Base T network FortiGate
61. tiGate unit to your network 42 After you complete the initial configuration of the FortiGate 3600 unit you can connect the FortiGate 3600 between your internal network and the Internet and to other networks There is one 10 100Base TX interface interface 1 on the FortiGate 3600 that can be connected to a 10 100 Base T network There are two copper gigabit ethernet connectors on the FortiGate 3600 e Internal for connecting to your internal network e External for connecting to your public switch or router and the Internet There are four fiber optic gigabit ethernet connectors on the FortiGate 3600 e port 2 port 3 port 4 and port 5 HA for connecting to networks To connect the FortiGate 3600 unit running in Transparent mode Connect the Internal interface to the hub or switch connected to your internal network Connect the External interface to the public switch or router provided by your Internet Service Provider Optionally connect ports 1 to 5 HA to hubs or switches connected to your other networks 01 28005 0027 20041101 Fortinet Inc Transparent mode installation Next steps Figure 10 FortiGate 3600 Transparent mode connections Other Network Internal Network Pa 2 B Switch or Router Switch or router oma ip Port 1 Port 4 mn l FonriSere 3600 FortiGate 3600 aaa Public Switch or Router m Internet y You can use the following information to configure FortiGat
62. tion and must be separated by spaces For example set allowaccess ping https ssh snmp http telnet You can enter any of the following set allowaccess ping set allowaccess ping https ssh set allowaccess https ping ssh set allowaccess snmp In most cases to make changes to lists that contain options separated by spaces you need to retype the whole list including all the options you want to apply and excluding all the options you want to remove 01 28005 0027 20041101 Fortinet Inc Introduction Fortinet documentation Fortinet documentation Information about FortiGate products is available from the following FortiGate User Manual volumes FortiGate QuickStart Guide Each QuickStart Guide provides the basic information required to connect and install a FortiGate model FortiGate Installation Guide Each nstallation Guide provides detailed information required to install a FortiGate model Includes hardware reference default configuration installation procedures connection procedures and basic configuration procedures FortiGate Administration Guide Each Administration Guide describes how to configure a FortiGate model Configuration information includes how to use FortiGate firewall policies to control traffic flow through the FortiGate unit and how to configure VPN IPS antivirus web filtering spam filtering The administration guide also describes how to use protection profiles to apply intrusion prevention a
63. ty demanded by large enterprises and service providers The mwen FortiGate 3600 uses multiple CPUs and FortiASIC chips to deliver throughput of 4Gbps meeting the needs of the most demanding applications Each FortiGate 3600 unit includes redundant power supplies to minimize single point failures and also supports load balanced operation and redundant failover with no interruption in service The FortiGate 3600 includes one 10 100 BaseTX port four Gigabit fibre ports and two Gigabit ethernet ports The high capacity reliability and easy management of the FortiGate 3600 makes it a natural choice for managed service offerings mM o EII FortiGate 3600 Installation Guide 01 28005 0027 20041101 9 Secure installation configuration and management Introduction Secure installation configuration and management The FortiGate unit default configuration includes default interface IP addresses and is only a few steps away from protecting your network There are several ways to configure basic FortiGate settings e the web based manager e the front panel control buttons and LCD e the command line interface CLI or e the setup wizard The CLI or the web based manager can then be used to complete configuration and to perform maintenance and administration Web based manager Using HTTP or a secure HTTPS connection from any computer running Internet Explorer you can configure and manage the FortiGate unit The web based manager
64. units in HA mode go to High availability installation on page 45 24 01 28005 0027 20041101 Fortinet Inc RAT MET NAT Route mode installation This chapter describes how to install the FortiGate unit in NAT Route mode For information about installing a FortiGate unit in Transparent mode see Transparent mode installation on page 37 For information about installing two or more FortiGate units in HA mode see High availability installation on page 45 For more information about installing the FortiGate unit in NAT Route mode see Planning the FortiGate configuration on page 20 This chapter describes e Preparing to configure the FortiGate unit in NAT Route mode e Using the web based manager e Using the front control buttons and LCD e Using the command line interface e Using the setup wizard e Connecting the FortiGate unit to the network s e Configuring the networks e Next steps Preparing to configure the FortiGate unit in NAT Route mode Use Table 5 to gather the information that you need to customize NAT Route mode settings You can configure the FortiGate unit in several ways the web based manager GUI is a complete interface for configuring most settings See Using the web based manager on page 27 e the front control buttons and LCD provide access to the most important basic settings Using the front control buttons and LCD on page 28 e the command line interface CLI is a c
65. witch to Transparent mode Then you can add the management IP address and default gateway Setup wizard If you are configuring the FortiGate unit to operate in NAT Route mode the default you can use the setup wizard to e add the administration password e configure the internal interface address e choose either a manual static or a dynamic DHCP or PPPoE address for the external interface add a default route for the external interface e add the DNS server IP addresses e add the DHCP server settings and IP addresses e add various internal server IP addresses including web IMAP POP3 SMTP and FTP servers e set the antivirus protection to high medium or none FortiGate 3600 Installation Guide 01 28005 0027 20041101 23 Next steps Getting started If you are configuring the FortiGate unit to operate in Transparent mode you can switch to Transparent mode from the web based manager and then use the setup wizard to add the administration password the management IP address and gateway and the DNS server addresses Next steps Now that your FortiGate unit is operating you can proceed to configure it to connect to networks If you are going to operate the FortiGate unit in NAT Route mode go to NAT Route mode installation on page 25 e If you are going to operate the FortiGate unit in Transparent mode go to Transparent mode installation on page 37 e If you are going to operate the or more FortiGate

FortiGate 3600 Installation Guide

Contents

Download Pdf Manuals

Related Search

Related Contents