Home

Fortinet MR8 User's Manual

Contents

1. config system global set hostname lt name_str gt end 01 28008 0018 20050128 Fortinet Inc High availability installation Connecting the cluster to your networks To configure the FortiGate unit for HA operation Configure HA settings Use the following command to Set the HA mode e Set the Group ID e Change the unit priority Enable override master e Enter an HA password e Select an active active HA schedule config system ha set mode a a a p standalone set groupid lt id_integer gt set priority lt priority integer gt set override disable enable set password lt password str gt set schedule hub ip ipport leastconnection none random round robin weight round robin end The FortiGate unit negotiates to establish an HA cluster If you are configuring a NAT Route mode cluster power off the FortiGate unit and then repeat this procedure for all the FortiGate units in the cluster Once all of the units are configured continue with Connecting the cluster to your networks on page 51 If you are configuring a Transparent mode cluster switch the FortiGate unit to Transparent mode config system global set opmode transparent end Allow the FortiGate unit to restart in Transparent mode and then power off the FortiGate unit Repeat this procedure for all of the FortiGate units in the cluster then continue with Connecting the cluster to your networks on page 51 Connecting t
2. In this configuration you would create NAT mode firewall policies to control traffic flowing between the internal private network and the external public network usually the Internet If you have multiple internal networks such as a DMZ network in addition to the internal private network you could create route mode firewall policies for traffic flowing between them Figure 6 Example NAT Route mode network configuration Internal network i 192 168 1 3 FortiGate 60 Unit nemal in NAT Route mode 192 168 1 99 204 23 1 5 Int t Route mode policies nterne controlling traffic between x internal networks lt gt DMZ DMZ network NAT mode policies controlling 10 10 10 1 traffic between internal and external networks 10 10 10 2 NAT Route mode with multiple external network connections In NAT Route mode you can configure the FortiGate unit with multiple redundant connections to the external network usually the Internet For example you could create the following configuration e WAN is the default interface to the external network usually the Internet e WAN2Z is the redundant interface to the external network You can also use the modem interface as a redundant connection to the external network Internal is the interface to the internal network You must configure routing to support redundant Internet connections Routing can be used to automatically redirect connections from an interface if it
3. The FortiGate unit performs firewall functions IPSec VPN virus scanning IPS web content filtering and Spam filtering Figure 8 Example Transparent mode network configuration FortiGate 60 Unit in Transparent mode Gateway to public network 204 23 1 5 10 10 10 2 10 10 10 1 Management IP WAN1 firewall router Internal Internal network gt Transparent mode policies 10 10 10 3 trolli traffic betw 5 a sn oz curate vor You can connect up to four network segments to the FortiGate unit to control traffic between these network segments e A 4 port switch for connecting the FortiGate internal interface to your internal network segment WAN1 can connect to the external firewall or router DMZ and WAN2 can connect to other network segments Note The modem interface is not available in Transparent mode 01 28008 0018 20050128 25 Next steps Getting started Configuration options Next steps 26 Once you have selected Transparent or NAT Route mode operation you can complete the configuration plan and begin to configure the FortiGate unit Choose among three different tools to configure the FortiGate unit Web based manager and setup wizard The FortiGate web based manager is a full featured management tool You can use the web based manager to configure most FortiGate settings The web based manager Setup Wizard guides you through the initial configuration steps Use the Setup Wizard to
4. dial on demand 58 E environmental specifications 15 F firewall policies modem 60 firewall setup wizard 6 28 32 40 43 starting 29 34 40 43 Fortinet customer service 10 H HA configuring FortiGate units for HA operation 47 connecting an HA cluster 51 53 FortiGate 60 Installation Guide RAT MET hang up 57 High availability 47 holddown timer 58 HTTPS 6 internal network configuring 36 IP addresses configuring from the CLI 41 L lease duration DHCP 20 management IP address transparent mode 42 modem adding firewall policies 60 configuring settings 57 redundant mode 55 standalone mode 55 56 N NAT Route mode configuration from the CLI 30 NTP 37 45 NTP server 37 45 P ping server 59 power reguirements 15 powering on 15 R redial limit 58 redundant mode configuring 55 modem 55 01 28008 0018 20050128 61 Index S set time 37 45 setup wizard 28 32 40 43 starting 29 34 40 43 standalone mode configuring 56 modem 55 56 starting IP DHCP 20 synchronize with NTP server 37 45 T technical support 10 62 time zone 37 45 Transparent mode changing to 41 configuring the default gateway 42 management IP address 42 W web based manager 6 connecting to 16 introduction 6 wizard setting up firewall 28 32 40 43 starting 29 34 40 43 01 28008 0018 20050128 Fortinet Inc
5. the FortiGate system date and time must be accurate You can either manually set the system date and time or configure the FortiGate unit to automatically keep its time correct by synchronizing with a Network Time Protocol NTP server 1 Go to System gt Config gt Time 2 Select Refresh to display the current FortiGate system date and time 3 Select a Time Zone from the list 4 Optionally select Automatically adjust clock for daylight saving changes check box 5 Select Set Time and set the FortiGate system date and time 6 Set the hour minute second month day and year as reguired 7 Select Apply To use NTP to set the FortiGate date and time 1 Go to System gt Config gt Time 2 Select Synchronize with NTP Server to configure the FortiGate unit to use NTP to automatically set the system time and date 3 Enter the IP address or domain name of the NTP server that the FortiGate unit can use to set its time and date Specify how often the FortiGate unit should synchronize its time with the NTP server Select Apply To register the FortiGate unit After purchasing and installing a new FortiGate unit you can register the unit by going to the System Update Support page or using a web browser to connect to http support fortinet com and selecting Product Registration To register enter your contact information and the serial numbers of the FortiGate units that you or your organization have purchased You can register multiple
6. 23 1 2 and this gateway is connected to port 2 config router static edit 1 set dst 0 0 0 0 0 0 0 0 set gateway 204 23 1 2 set device port2 end Using the setup wizard BO N 3 From the web based manager you can use the setup wizard to begin the initial configuration of the FortiGate unit For information about connecting to the web based manager see Connecting to the web based manager on page 16 The first time you connect to the FortiGate unit it is configured to run in NAT Route mode To switch to Transparent mode using the web based manager Go to System gt Status Select Change beside the Operation Mode Select Transparent in the Operation Mode list Select OK To reconnect to the web based manager change the IP address of the management computer to 10 10 10 2 Connect to the internal or DMZ interface and browse to https followed by the Transparent mode management IP address The default FortiGate Transparent mode management IP address is 10 10 10 1 To start the setup wizard Select Easy Setup Wizard the middle button in the upper right corner of the web based manager Use the information that you gathered in Table 9 on page 40 to fill in the wizard fields Select the Next button to step through the wizard pages Confirm your configuration settings and then select Finish and Close Reconnecting to the web based manager FortiGate 60 Installation Guide If you changed the IP address of the manag
7. 99 to each computer on the internal network As a result the FortiGate unit internal interface acts as a DNS server for the internal network Using DNS forwarding the FortiGate unit forwards DNS requests received from the internal network to the DNS server IP addresses added to the FortiGate unit configuration and returns lookup results to the internal network For more information about default DHCP server settings see Factory default DHCP server configuration on page 19 The following procedure describes how to configure your internal network and the FortiGate unit to use the FortiGate default settings Connect the FortiGate unit between the internal network and the Internet and turn on the power Set the TCP IP properties of the network computers to obtain an IP address automatically and a DNS server IP address automatically using DHCP From the management computer browse to https 192 168 1 99 The FortiGate web based manager appears Go to System gt Network gt Interface and select Edit for the WANT1 interface Select one of the following Addressing modes e Manual enter a static IP address and netmask select OK and go to step 6 e DHCP to get an IP address from the ISP select DHCP and go to step 9 PPPoE to get an IP address from the ISP select PPPoE and go to step 9 Go to System gt Network gt DNS 01 28008 0018 20050128 Fortinet Inc Getting started Factory default FortiGate configuration settings 7 Sele
8. FortiGate unit as the DHCP server for your internal network configure the computers on your internal network for DHCP Make sure that the connected FortiGate unit is functioning properly by connecting to the Internet from a computer on the internal network You should be able to connect to any Internet address Configuring the Modem interface Next steps 36 In NAT Route mode you use the modem interface as either a redundant interface or standalone interface to the Internet e In redundant mode the modem interface automatically takes over from a selected ethernet interface when that ethernet interface is unavailable e In standalone mode the modem interface is the connection from the FortiGate unit to the Internet When connecting to the ISP in either configuration the FortiGate unit modem can automatically dial up to three dialup accounts until the modem connects to an ISP The modem interface connects to the FortiGate USB interface You must connect an external modem to the USB interface You can use the following information to configure FortiGate system time to register the FortiGate unit and to configure antivirus and attack definition updates Refer to the FortiGate Administration Guide for complete information on configuring monitoring and maintaining the FortiGate unit 01 28008 0018 20050128 Fortinet Inc NAT Route mode installation Next steps To set the date and time For effective scheduling and logging
9. Network Mask 255 255 255 0 Lease Duration 7 days DNS Server 1 192 168 1 99 Factory default NAT Route mode network configuration When the FortiGate unit is first powered on it is running in NAT Route mode and has the basic network configuration listed in Table 3 on page 20 This configuration allows you to connect to the FortiGate unit web based manager and establish the configuration required to connect the FortiGate unit to the network In Table 3 on page 20 HTTPS administrative access means you can connect to the web based manager using HTTPS protocol through this interface Ping administrative access means this interface responds to ping requests Table 3 Factory default NAT Route mode network configuration Administrative Access Administrator User name admin account Password none IP 192 168 1 99 Internal interface Netmask 255 255 255 0 Administrative Access HTTP HTTPS Ping IP 192 168 100 99 WAN interface Netmask 255 255 255 0 Ping Administrative Access IP 192 168 101 99 WAN2 interface Netmask 255 255 255 0 Administrative Access Ping IP 10 10 10 1 DMZ interface Netmask 255 255 255 0 Administrative Access HTTPS Ping IP 0 0 0 0 Modem interface Netmask 0 0 0 0 01 28008 0018 20050128 Fortinet Inc Getting started Factory default FortiGate configuration settings Table 3 Factory default NAT Route mode network configuration Continued Default Gatewa
10. PPPoE addressing select PPPoE and enter the username and password and any other required settings For information about how to configure these and other interface settings see the FortiGate online help or the FortiGate Administration Guide Select OK Repeat this procedure for each interface Note If you change the IP address of the interface you are connecting to you must connect through a web browser again using the new address Browse to https followed by the new IP address of the interface If the new IP address of the interface is on a different subnet you may have to change the IP address of your computer to the same subnet To configure DNS server settings Go to System gt Network gt DNS Enter the IP address of the primary DNS server Enter the IP address of the secondary DNS server Select OK To add a default route Add a default route to configure where the FortiGate unit sends traffic destined for an external network usually the Internet Adding the default route also defines which interface is connected to an external network The default route is not required if the interface connected to the external network is configured using DHCP or PPPoE 01 28008 0018 20050128 29 Using the command line interface NA T Route mode installation ON O a R Q Go to System gt Router gt Static If the Static Route table contains a default route IP and Mask set to 0 0 0 0 select the Delete icon to delete this ro
11. Transparent mode Enter get system status 01 28008 0018 20050128 41 Using the command line interface Transparent mode installation The CLI displays the status of the FortiGate unit including the following line of text Operation mode Transparent To configure the management IP address 1 Make sure that you are logged into the CLI 2 Setthe management IP address and netmask to the IP address and netmask that you recorded in Table 9 on page 40 Enter config system manageip set ip lt address ip gt lt netmask gt end Example config system manageip set ip 10 10 10 2 255 255 255 0 end 3 Confirm that the address is correct Enter get system manageip The CLI lists the management IP address and netmask To configure DNS server settings 1 Set the primary and secondary DNS server IP addresses Enter config system dns set primary lt address ip gt set secondary lt address ip gt end Example config system dns set primary 293 44 75 21 set secondary 293 44 75 22 end To configure the default gateway 1 Make sure that you are logged into the CLI 2 Set the default route to the default gateway that you recorded in Table 9 on page 40 Enter config router static edit 1 set dst 0 0 0 0 0 0 0 0 set gateway lt address gateway gt set device lt interface gt end 42 01 28008 0018 20050128 Fortinet Inc Transparent mode installation Using the setup wizard Example If the default gateway IP is 204
12. connectivity with the FortiProtect Distribution Network FDN To be able to connect to the FDN the FortiGate unit default route must point to a network such as the Internet to which a connection to the FDN can be established If FortiProtect Distribution Network changes to Available then the FortiGate unit can connect to the FDN Select Scheduled Update and configure a schedule for receiving antivirus and attack definition updates Select Apply You can also select Update Now to receive the latest virus and attack definition updates 01 28008 0018 20050128 Fortinet Inc RAT MET High availability installation This chapter describes how to install two or more FortiGate units in an HA cluster HA installation involves three basic steps e Configuring FortiGate units for HA operation e Connecting the cluster to your networks e Installing and configuring the cluster For information about HA see the FortiGate Administration Guide and the FortiOS High Availability technical note Priorities of heartbeat device and monitor priorities The procedures in this chapter do not include steps for changing the priorities of heartbeat devices or for configuring monitor priorities settings Both of these HA settings should be configured after the cluster is up and running Configuring FortiGate units for HA operation A FortiGate HA cluster consists of two or more FortiGate units with the same HA configuration This section describes
13. how to configure each of the FortiGate units to be added to a cluster for HA operation The procedures are the same for active active and active passive HA e High availability configuration settings e Configuring FortiGate units for HA using the web based manager Configuring FortiGate units for HA using the CLI High availability configuration settings Use the following table to select the HA configuration settings for the FortiGate units in the HA cluster FortiGate 60 Installation Guide 01 28008 0018 20050128 47 Configuring FortiGate units for HA operation 48 High availability installation Table 10 High availability settings Mode Active Active Load balancing and failover HA Each FortiGate unit in the HA cluster actively processes connections and monitors the status of the other FortiGate units in the cluster The primary FortiGate unit in the cluster controls load balancing Active Passive Failover HA The primary FortiGate unit in the cluster processes all connections All other FortiGate units in the cluster are passively monitor the cluster status and remain synchronized with the primary FortiGate unit All members of the HA cluster must be set to the same HA mode Group ID The group ID range is from 0 to 63 All members of the HA cluster must have the same group ID When the FortiGate units in the cluster are switched to HA mode all of the interfaces of all of the units in the cluster
14. notes product and feature guides and much more Visit the Fortinet Knowledge Center at http kc forticare com Comments on Fortinet technical documentation Please send information about any errors or omissions in this document or any Fortinet technical documentation to techdoc fortinet com Related documentation Additional information about Fortinet products is available from the following related documentation FortiManager documentation FortiManager QuickStart Guide Explains how to install the FortiManager Console set up the FortiManager Server and configure basic settings FortiManager System Administration Guide Describes how to use the FortiManager System to manage FortiGate devices FortiManager System online help Provides a searchable version of the Administration Guide in HTML format You can access online help from the FortiManager Console as you work FortiClient documentation FortiGate 60 Installation Guide FortiClient Host Security User Guide Describes how to use FortiClient Host Security software to set up a VPN connection from your computer to remote networks scan your computer for viruses and restrict access to your computer and applications by setting up firewall policies FortiClient Host Security online help Provides information and procedures for using and configuring the FortiClient software 01 28008 0018 20050128 9 Customer service and technical support Introduction FortiMail docum
15. recommended Add this protection profile to a default firewall policy None Do not configure antivirus protection Select one of these security levels to protect your network from viruses Starting the setup wizard 1 In the web based manager select Easy Setup Wizard Figure 9 Select the Easy Setup Wizard Follow the instructions on the wizard pages and use the information that you gathered in Table 6 on page 28 and Table 8 on page 33 to fill in the wizard fields Select the Next button to step through the wizard pages Confirm the configuration settings and then select Finish and Close Note If you change the IP address of the interface you are connecting to you must connect through a web browser again using the new address Browse to https followed by the new IP address of the interface If the new IP address of the interface is on a different subnet you may have to change the IP address of your computer to the same subnet Note If you use the setup wizard to configure internal server settings the FortiGate unit adds port forwarding virtual IPs and firewall policies for each server For each server located on your internal network the FortiGate unit adds a WAN1 gt Internal firewall policy You are now finished the initial configuration of the FortiGate unit Connecting the FortiGate unit to the network s 34 When you have completed the initial configuration you can connect the FortiGate uni
16. select Override master Enter and confirm a password for the HA cluster If you are configuring Active Active HA select a schedule Select Apply The FortiGate unit negotiates to establish an HA cluster When you select apply you may temporarily lose connectivity with the FortiGate unit as the negotiation takes place If you are configuring a NAT Route mode cluster power off the FortiGate unit and then repeat this procedure for all the FortiGate units in the cluster Once all of the units are configured continue with Connecting the cluster to your networks on page 51 If you are configuring a Transparent mode cluster reconnect to the web based manager You may have to wait a few minutes before you can reconnect Go to System gt Status Select Change to Transparent Mode and select OK to switch the FortiGate unit to Transparent mode Allow the FortiGate unit to restart in Transparent mode and then power off the FortiGate unit Repeat this procedure for all of the FortiGate units in the cluster Once all units are configured continue with Connecting the cluster to your networks on page 51 Configuring FortiGate units for HA using the CLI Use the following procedure to configure each FortiGate unit for HA operation To change the FortiGate unit host name Power on the FortiGate unit to be configured Connect to the CLI See Connecting to the command line interface CLI on page 17 Change the host name
17. AVAL AL WAVVAAAAL AVAL VALAAAAA WWW ALN Waititi VUV i wih wit n AAAARRATARRRRLANA TOTTI MEE INTERNAL 3 5 RTIMET STATUS 1 2 3 4 DMZ WAN1 WAN2 E EE EE HEE EE EE HEE EE LINK100 LINK100 LINK100 LINK100 LINK100 LINK4100 LINK 100 ForriGare 60 Version 2 80 MR8 28 January 2005 01 28008 0018 20050128 Copyright 2005 Fortinet Inc All rights reserved No part of this publication including text examples diagrams or illustrations may be reproduced transmitted or translated in any form or by any means electronic mechanical manual optical or otherwise for any purpose without prior written permission of Fortinet Inc FortiGate 60 Installation Guide Version 2 80 MR8 28 January 2005 01 28008 0018 20050128 Trademarks Products mentioned in this document are trademarks or registered trademarks of their respective holders Regulatory Compliance FCC Class A Part 15 CSA CUS For technical support please visit http www fortinet com Send information about errors or omissions in this document or any Fortinet technical documentation to techdoc fortinet com Table of Contents o eo o a cece ee cedce epetiedars raies pi dibrer aasad odiare iE Eni 5 Secure installation configuration and management eee eee eee 5 Web based manager isc cistticcaniesetacedsiilthiecenevdddge ds e ettcaeenseetderedgesieiegss jebde edn fudlsk eats 6 Command ling interface secerneren A lieeetenvieens 6 Setup wi
18. FortiGate units in a single session without re entering your contact information To configure virus attack and spam definition updates You can configure the FortiGate unit to automatically keep virus grayware and attack definitions up to date FortiGate 60 Installation Guide 01 28008 0018 20050128 37 Next steps 38 NA T Route mode installation Go to System gt Maintenance gt Update Center Select Refresh to test the FortiGate unit connectivity with the FortiProtect Distribution Network FDN To be able to connect to the FDN the FortiGate unit default route must point to a network such as the Internet to which a connection to the FDN can be established If FortiProtect Distribution Network changes to Available then the FortiGate unit can connect to the FDN Select Scheduled Update and configure a schedule for receiving antivirus and attack definition updates Select Apply You can also select Update Now to receive the latest virus and attack definition updates For more information about FortiGate settings see the FortiGate Online Help or the FortiGate Administration Guide 01 28008 0018 20050128 Fortinet Inc RAT MET Transparent mode installation This chapter describes how to install a FortiGate unit in Transparent mode If you want to install the FortiGate unit in NAT Route mode see NAT Route mode installation on page 27 If you want to install two or more FortiGate units in HA mode see High av
19. Go to System gt Config gt Options For Detection Interval type a number in seconds to specify how often the FortiGate unit tests the connection to the ping target 01 28008 0018 20050128 59 Adding firewall policies for modem connections Configuring the modem interface 60 3 For Fail over Detection type a number of times that the connection test fails before the FortiGate unit assumes that the gateway is no longer functioning 4 Select Apply Adding firewall policies for modem connections The modem interface reguires firewall addresses and policies You can add one or more addresses to the modem interface For information about adding addresses see the FortiGate Administration Guide When you add addresses the modem interface appears on the policy grid You can configure firewall policies to control the flow of packets between the modem interface and the other interfaces on the FortiGate unit For information about adding firewall policies see the FortiGate Administration Guide 01 28008 0018 20050128 Fortinet Inc Index A auto dial 57 C CLI 6 configuring IP addresses 41 configuring NAT Route mode 30 connecting to 17 cluster connecting 51 53 command line interface 6 configuring redundant mode 55 configuring standalone mode 56 connect cluster 51 53 connecting to network 34 44 web based manager 16 customer service 10 D default gateway configuring Transparent mode 42 default route 20 dial now 57
20. ailability installation on page 47 For more information about installing the FortiGate unit in Transparent mode see Planning the FortiGate configuration on page 23 This chapter describes e Preparing to configure Transparent mode e Using the web based manager e Using the command line interface e Using the setup wizard e Connecting the FortiGate unit to your network e Next steps Preparing to configure Transparent mode Use Table 9 to gather the information that you need to customize Transparent mode settings You can configure Transparent mode using four methods e the web based manager GUI e front control buttons and LCD command line interface CLI setup wizard The method you choose depends on the complexity of the configuration access and equipment and the type of interface you are most comfortable using FortiGate 60 Installation Guide 01 28008 0018 20050128 39 Using the web based manager Transparent mode installation Table 9 Transparent mode settings Administrator Password IP Netmask Default Gateway Management IP The management IP address and netmask must be valid for the network from which you will manage the FortiGate unit Add a default gateway if the FortiGate unit must connect to a router to reach the management computer Primary DNS Server DNS Settings Secondary DNS Server Using the web based manager You can use the web based manag
21. all is a dedicated easily managed security device that delivers a full suite of capabilities that include e application level services such as virus protection and content filtering e network level services such as firewall intrusion detection VPN and traffic shaping The FortiGate Antivirus Firewall uses Fortinet s Accelerated Behavior and Content Analysis System ABACAS technology which leverages breakthroughs in chip design networking security and content analysis The unique ASIC based architecture analyzes content and behavior in real time enabling key applications to be deployed right at the network edge where they are most effective at protecting your networks The FortiGate 60 model is ideally suited for small businesses remote Offices retail stores and telecommuters The FortiGate 60 Antivirus Firewall features dual WAN link support for redundant internet connections and an integrated 4 port switch that eliminates the need for an external hub or switch Networked devices connect directly to the FortiGate 60 unit F RTINET w a m wz wana Oo oa E oa 00 m ForriGare 60 The FortiGate 60 also supports advanced features such as 802 1Q VLANs virtual domains high availability HA and the RIP and OSPF routing protocols Secure installation configuration and management FortiGate 60 Installation Guide The FortiGate unit default configuration includes a default firewall policy and IP addre
22. b based manager 49 Configuring FortiGate units for HA using the CLI eee 50 Connecting the cluster to your NEtWOFKS ccccceeeeeeeeeeeeeeeeeseeeeeeeeeseeeeeeeeeteeeaaeeeseeeaeeees 51 Installing and configuring the C USter eee eee eeeee eee eee nene 53 Configuring the modem interface lt lt ereeeeeeeeeeeeeee anne nesen nenene 55 selecting amodem MOE sossar nanai AE E ANAN AAE EE 55 Redundant mode configuration eee nene 55 Standalone mode configuration 0 0 ee cece cent eee eeeete teeter taeeee eee ee eee eee nenene netto 56 Configuring modem settingS 4 22eeeeeee000eeeee 000 eee eee n 0 eee nenene nenene nn 57 Connecting and disconnecting the modem in Standalone Mode 58 Defining a PING Server ficss ci cectch evi edit inisin ieee ie bhaaleess 59 Dead gateway Uetections ccccccccccicceeseedgececespedee cane eeeghsveneesdeedeneeseedvenenensgiidedessedteneeessaees 59 Adding firewall policies for modem CONNECTIONS eee 60 OO cect eens eee tase ct aac eevee 61 4 01 28008 0018 20050128 Fortinet Inc AT MET Introduction FortiGate Antivirus Firewalls improve network security reduce network misuse and abuse and help you use communications resources more efficiently without compromising the performance of your network FortiGate Antivirus Firewalls are ICSA certified for firewall IPSec and antivirus services The FortiGate Antivirus Firew
23. cluster instead of managing the individual FortiGate units in the cluster You can configure and manage the cluster by connecting to the cluster web based manager using any cluster interface configured for HTTPS administrative access You can also configure and manage the cluster by connecting to the CLI using any cluster interface configured for SSH administrative access When you connect to the cluster you are actually connecting to the primary cluster unit The cluster automatically synchronizes all configuration changes to the subordinate units in the cluster as the changes are made The only configuration settings that are not synchronized are the HA configuration except for the interface heartbeat device and monitoring configuration and the FortiGate host name For more information about configuring a cluster see the FortiGate Administration Guide 01 28008 0018 20050128 53 Installing and configuring the cluster High availability installation 54 01 28008 0018 20050128 Fortinet Inc RAT MET Configuring the modem interface The FortiGate 60 includes the option of an external modem for use as either a redundant interface or a standalone interface in NAT Route mode e In redundant mode the modem interface automatically takes over from a selected ethernet interface when that ethernet interface is unavailable In standalone mode the modem interface is the connection from the FortiGate unit to the Internet When connectin
24. configure the administrator password the interface addresses the default gateway address and the DNS server addresses Optionally use the Setup Wizard to configure the internal server settings for NAT Route mode To connect to the web based manager you require Ethernet connection between the FortiGate unit and a management computer e Internet Explorer version 6 0 or higher on the management computer CLI The FortiGate CLI is a full featured management tool Use it to configure the administrator password the interface addresses the default gateway address and the DNS server addresses To connect to the CLI you require e Serial connection between the FortiGate unit and a management computer A terminal emulation application on the management computer If you are configuring the FortiGate unit to operate in Transparent mode you can switch to Transparent mode from the web based manager and then use the setup wizard to add the administration password the management IP address and gateway and the DNS server addresses Now that your FortiGate unit is operating you can proceed to configure it to connect to networks Ifyou are going to operate the FortiGate unit in NAT Route mode go to NAT Route mode installation on page 27 e If you are going to operate the FortiGate unit in Transparent mode go to Transparent mode installation on page 39 e If you are going to operate two or more FortiGate units in HA mo
25. content blocking to HTTP content traffic You can add this protection profile to firewall policies that control HTTP traffic Unfiltered To apply no scanning blocking or IPS Use if you do not want to apply content protection to content traffic You can add this protection profile to firewall policies for connections between highly trusted or highly secure networks where content does not need to be protected Figure 5 Web protection profile settings Edit Protection Profile Profile Name web w Anti Virus HTTP FTP IMAP POPS SMTP Virus Scan K O r File Black r r L E Pass Fragmented Emails IV Iv Vv Oversized File Email pass pass pass pass pass Add signature to outgoing emails T Enable zlsmre only Web Filtering I maaa v web Content Block Web URL Block Web Exempt List web Script Filter Planning the FortiGate configuration Before you configure the FortiGate unit you need to plan how to integrate the unit into the network Among other things you must decide whether you want the unit to be visible to the network which firewall functions you want it to provide and how you want it to control the traffic flowing between its interfaces Your configuration plan depends on the operating mode that you select The FortiGate unit can be configured in one of two modes NAT Route mode the default or Transparent mode You can also configure the FortiGate unit and the network it protects
26. ct one of the following DNS settings e Obtain DNS server address automatically select to get the DNS addresses from the ISP select Apply Use the following DNS server addresses select and enter the DNS server addresses given to you by the ISP select Apply 8 Goto Router gt Static edit route 1 and change Gateway to the default gateway IP address from the ISP and select OK Network configuration is complete Proceed to Next steps on page 26 9 Select Retrieve default gateway from server and Override internal DNS options if your ISP supports them select OK and proceed to Next steps on page 26 Go to step 6 if you are not selecting these options Factory default FortiGate configuration settings The FortiGate unit is shipped with a factory default configuration The default configuration allows you to connect to and use the FortiGate web based manager to configure the FortiGate unit onto the network To configure the FortiGate unit onto the network you add an administrator password change network interface IP addresses add DNS server IP addresses and configure basic routing if required If you plan to operate the FortiGate unit in Transparent mode you can switch to Transparent mode from the factory default configuration and then configure the FortiGate unit onto the network in Transparent mode Once the network configuration is complete you can perform additional configuration tasks such as setting system time configuring
27. ddition PPPoE unnumbered configurations reguire you to supply an IP address Use Table 7 to record the information you reguire for your PPPOE configuration Table 7 PPPOE settings User name Password Using the web based manager 28 You can use the web based manager for the initial configuration of the FortiGate unit You can also continue to use the web based manager for all FortiGate unit settings For information about connecting to the web based manager see Connecting to the web based manager on page 16 01 28008 0018 20050128 Fortinet Inc NAT Route mode installation Using the web based manager Configuring basic settings BO N BO N FortiGate 60 Installation Guide After connecting to the web based manager you can use the following procedures to complete the basic configuration of the FortiGate unit To add change the administrator password Go to System gt Admin gt Administrators Select the Change Password icon for the admin administrator Enter the new password and enter it again to confirm Select OK To configure interfaces Go to System gt Network gt Interface Select the edit icon for an interface Set the addressing mode for the interface Choose from manual DHCP or PPPOE Complete the addressing configuration e For manual addressing enter the IP address and netmask for the interface e For DHCP addressing select DHCP and any required settings e For
28. de go to High availability installation on page 47 01 28008 0018 20050128 Fortinet Inc RAT MET NAT Route mode installation This chapter describes how to install the FortiGate unit in NAT Route mode For information about installing a FortiGate unit in Transparent mode see Transparent mode installation on page 39 For information about installing two or more FortiGate units in HA mode see High availability installation on page 47 For more information about installing the FortiGate unit in NAT Route mode see Planning the FortiGate configuration on page 23 This chapter describes e Preparing to configure the FortiGate unit in NAT Route mode e Using the web based manager e Using the command line interface e Using the setup wizard e Connecting the FortiGate unit to the network s e Configuring the networks e Configuring the modem interface e Next steps Preparing to configure the FortiGate unit in NAT Route mode FortiGate 60 Installation Guide Use Table 6 on page 28 to gather the information that you need to customize NAT Route mode settings You can configure the FortiGate unit in several ways the web based manager GUI is a complete interface for configuring most settings See Using the web based manager on page 28 the command line interface CLI is a complete text based interface for configuring all settings See Using the command line interface on page 30 e the set
29. e modem interface is not connected to the ISP active The modem interface is attempting to connect to the ISP or is connected to the ISP A green check mark indicates the active dialup account The IP address and netmask assigned to the modem interface appears on the System Network Interface page of the web based manager To disconnect the modem Use the following procedure to disconnect the modem from a dialup account Go to System gt Network gt Modem Select Hang Up if you want to disconnect from the dialup account Defining a Ping Server Adding a ping server is required for routing failover for the modem in redundant mode A ping server confirms the connectivity to an ethernet interface To add a ping server to an interface Go to System gt Network gt Interface Choose an interface and select Edit Set Ping Server to the IP address of the next hop router on the network connected to the interface Select the Enable check box Select OK to save the changes Dead gateway detection FortiGate 60 Installation Guide The FortiGate unit uses dead gateway detection to ping the Ping Server IP address to make sure that the FortiGate unit can connect to this IP address Modify dead gateway detection to control how the FortiGate unit confirms connectivity with a ping server added to an interface configuration For information about adding a ping server to an interface above To modify the dead gateway detection settings
30. e must be the same for all FortiGate units in the HA cluster None No load balancing Select None when the cluster interfaces are connected to load balancing switches Hub Load balancing for hubs Select Hub if the cluster interfaces are connected to a hub Traffic is distributed to units in a cluster based on the Source IP and Destination IP of the packet Least Connection Least connection load balancing If the FortiGate units are connected using switches select Least connection to distribute traffic to the cluster unit with the fewest concurrent connections Round Robin Weighted Round Robin Round robin load balancing If the FortiGate units are connected using switches select round robin to distribute traffic to the next available cluster unit Weighted round robin load balancing Similar to round robin but weighted values are assigned to each of the units in a cluster based on their capacity and on how many connections they are currently processing For example the primary unit should have a lower weighted value because it handles scheduling and forwards traffic Weighted round robin distributes traffic more evenly because units that are not processing traffic will be more likely to receive new connections than units that are very busy Random Random load balancing If the FortiGate units are connected using switches select random to randomly distribute traffic to cluster units Load bala
31. ee dialup accounts The FortiGate unit tries connecting to each account in order until a connection can be established Phone Number The phone number reguired to connect to the dialup account Do not add spaces to the phone number Make sure to include standard special characters for pauses country codes and other functions as reguired by your modem to connect to your dialup account User Name The user name maximum 63 characters sent to the ISP Password The password sent to the ISP You can configure and use the modem in NAT Route mode only To configure modem settings Go to System gt Network gt Modem Select Enable Modem Change any of the following dialup connection settings Enter the following Dialup Account 1 settings If you have multiple dialup accounts enter Phone Number User Name and Password for Dialup Account 2 and Dialup Account 3 Select Apply Connecting and disconnecting the modem in Standalone mode 58 BO N To connect to a dialup account Go to System gt Network gt Modem Select Enable Modem Make sure there is correct information in one or more Dialup Accounts Select Apply if you make any configuration changes 01 28008 0018 20050128 Fortinet Inc Configuring the modem interface Defining a Ping Server Select Dial Now The FortiGate unit initiates dialing into each dialup account in turn until the modem connects to an ISP Modem status is one of the following not active Th
32. eight 14 1 5 Ib 0 68 kg 01 28008 0018 20050128 Fortinet Inc Getting started Power reguirements DC input voltage 12 V e DC input current 3 A Turning the FortiGate unit power on and off Environmental specifications e Operating temperature 32 to 104 F 0 to 40 C e Storage temperature 13 to 158 F 25 to 70 C e Humidity 5 to 95 non condensing Turning the FortiGate unit power on and off FortiGate 60 Installation Guide To power on the FortiGate unit Connect the AC adapter to the power connection at the back of the FortiGate 60 unit Connect the AC adapter to the power cable Connect the power cable to a power outlet The FortiGate 60 unit starts The Power and Status LEDs are on Table 1 FortiGate 60M LED indicators LED State Description Power Green The FortiGate unit is powered on Off The FortiGate unit is powered off Status Green The FortiGate unit is starting up Off The FortiGate unit is running normally Link Green The correct cable is in use and the connected Internal equipment has power een Flashing Green Network activity at this interface WAN2 Off No link established 100 Green The interface is connected at 100 Mbps Internal DMZ WAN1 WAN2 To power off the FortiGate unit Always shut down the FortiGate operating system properly before turning off the power switch From the web based manager go to System gt Maintenance gt S
33. ement interface while you were using the setup wizard you must reconnect to the web based manager using the new IP address Browse to https followed by the new IP address of the management interface Otherwise you can reconnect to the web based manager by browsing to https 10 10 10 1 If you connect to the management interface through a router make sure that you have added a default gateway for that router to the management IP default gateway field 01 28008 0018 20050128 43 Connecting the FortiGate unit to your network Transparent mode installation Connecting the FortiGate unit to your network 44 When you have completed the initial configuration you can connect the FortiGate unit between your internal network and the Internet using the Internal and WAN1 interfaces You can also connect networks to the DMZ interface and the WAN2 interface There are seven 10 100Base TX connectors on the FortiGate 60 e Four Internal ports for connecting to your internal network e WAN1 can connect to an external firewall or router DMZ and WAN2 can connect to other network segments To connect the FortiGate unit running in Transparent mode Connect the Internal interface connectors to PCs and other network devices in your internal network The Internal interface functions as a switch allowing up to four devices to be connected to the internal network and the internal interface Connect the WAN1 interface to the network segment connected
34. entation FortiMail Administration Guide Describes how to install configure and manage a FortiMail unit in gateway mode and server mode including how to configure the unit create profiles and policies configure antispam and antivirus filters create user accounts and set up logging and reporting e FortiMail online help Provides a searchable version of the Administration Guide in HTML format You can access online help from the web based manager as you work FortiMail Web Mail Online Help Describes how to use the FortiMail web based email client including how to send and receive email how to add import and export addresses and how to configure message display preferences FortiLog documentation FortiLog Administration Guide Describes how to install and configure a FortiLog unit to collect FortiGate and FortiMail log files It also describes how to view FortiGate and FortiMail log files generate and view log reports and use the FortiLog unit as a NAS server e FortiLog online help Provides a searchable version of the Administration Guide in HTML format You can access online help from the web based manager as you work Customer service and technical support 10 For antivirus and attack definition updates firmware updates updated product documentation technical support information and other resources please visit the Fortinet technical support web site at http support fortinet com You can also regist
35. er FortiGate Antivirus Firewalls from http support fortinet com and change your registration information at any time Fortinet email support is available from the following addresses amer supportefortinet com For customers in the United States Canada Mexico Latin America and South America apac_support fortinet com For customers in Japan Korea China Hong Kong Singapore Malaysia all other Asian countries and Australia eu_support fortinet com For customers in the United Kingdom Scandinavia Mainland Europe Africa and the Middle East 01 28008 0018 20050128 Fortinet Inc Introduction FortiGate 60 Installation Guide Customer service and technical support For information on Fortinet telephone support see http support fortinet com When reguesting technical support please provide the following information Your name Company name Location Email address Telephone number FortiGate unit serial number FortiGate model FortiGate FortiOS firmware version Detailed description of the problem 01 28008 0018 20050128 11 Customer service and technical support Introduction 12 01 28008 0018 20050128 Fortinet Inc RAT MET Getting started This section describes unpacking setting up and powering on a FortiGate Antivirus Firewall unit This section includes FortiGate 60 Installation Guide Package contents Mounting Turning the FortiGate unit power on and off Connecting to the web based manager Co
36. er to complete the initial configuration of the FortiGate unit You can continue to use the web based manager for all FortiGate unit settings For information about connecting to the web based manager see Connecting to the web based manager on page 16 The first time you connect to the FortiGate unit it is configured to run in NAT Route mode To switch to Transparent mode using the web based manager Go to System gt Status Select Change beside the Operation Mode Select Transparent in the Operation Mode list Select OK To reconnect to the web based manager change the IP address of the management computer to 10 10 10 2 Connect to the internal or DMZ interface and browse to https followed by the Transparent mode management IP address The default FortiGate Transparent mode management IP address is 10 10 10 1 BO N To change the Management IP 1 Go to System gt Network gt Management 2 Enter the management IP address and netmask that you recorded in Table 9 on page 40 3 Select access methods and logging for any interfaces as required Select Apply 40 01 28008 0018 20050128 Fortinet Inc Transparent mode installation BO N 3 Using the command line interface To configure DNS server settings Go to System gt Network gt DNS Enter the IP address of the primary DNS server Enter the IP address of the secondary DNS server Select OK To configure the default gateway Go to System gt Networ
37. et opmode nat transparent You can enter set opmode nat Orset opmode transparent Square brackets to indicate that a keyword or variable is optional For example show system interface lt name_str gt To show the settings for all interfaces you can enter show system interface To show the settings for the internal interface you can enter show system interface internal A space to separate options that can be entered in any combination and must be separated by spaces 01 28008 0018 20050128 7 FortiGate documentation Introduction For example set allowaccess ping https ssh snmp http telnet You can enter any of the following set allowaccess ping set allowaccess ping https ssh set allowaccess https ping ssh set allowaccess snmp In most cases to make changes to lists that contain options separated by spaces you need to retype the whole list including all the options you want to apply and excluding all the options you want to remove FortiGate documentation Information about FortiGate products is available from the following guides FortiGate AuickStart Guide Provides basic information about connecting and installing a FortiGate unit FortiGate Installation Guide Describes how to install a FortiGate unit Includes a hardware reference default configuration information installation procedures connection procedures and basic configuration procedures Choose the guide for your product model number F
38. g server for that interface You must also configure firewall policies for connections between the modem interface and other FortiGate interfaces Note Do not add policies for connections between the modem interface and the interface that the modem is backing up To configure backup modeTo configure a redundant modem connection Go to System gt Network gt Modem Select Redundant for the mode From the Redundant for list select the ethernet interface that you want the modem to back up Configure other modem settings as reguired Configuring modem settings on page 57 Configure a ping server for the ethernet interface selected in step 3 See Defining a Ping Server on page 59 Configure firewall policies for connections to the modem interface See Adding firewall policies for modem connections on page 60 Standalone mode configuration In standalone mode you manually connect the modem to a dialup account The modem interface operates as the primary connection to the Internet The FortiGate unit routes traffic through the modem interface which remains permanently connected to the dialup account If the connection to the dialup account fails the FortiGate unit automatically redials the modem The modem redials the ISP number based on the amount of times specified by the redial limit or until it connects to a dialup account In standalone mode the modem interface replaces the WAN1 or WAN2 ethernet interface When conf
39. g for HTTP firewall policies e Configure Web category filtering for HTTP firewall policies e Configure spam filtering for IMAP POP3 and SMTP firewall policies Enable the Intrusion Protection System IPS for all services e Enable content logging for HTTP FTP IMAP POP3 and SMTP firewall policies Using protection profiles you can build protection configurations that can be applied to different types of firewall policies This allows you to customize types and levels of protection for different firewall policies For example while traffic between internal and external addresses might need strict protection traffic between trusted internal addresses might need moderate protection You can configure firewall policies for different traffic services to use the same or different protection profiles Protection profiles can be added to NAT Route mode and Transparent mode firewall policies The FortiGate unit comes preconfigured with four protection profiles Strict To apply maximum protection to HTTP FTP IMAP POP3 and SMTP traffic You may not use the strict protection profile under normal circumstances but it is available if you have problems with viruses and reguire maximum screening Scan To apply antivirus scanning and file guarantining to HTTP FTP IMAP POP3 and SMTP content traffic 22 01 28008 0018 20050128 Fortinet Inc Getting started Planning the FortiGate configuration Web To apply antivirus scanning and web
40. g to an ISP in either configuration the modem can automatically dial up to three dialup accounts until the modem connects to an ISP This chapter describes e Selecting a modem mode e Configuring modem settings e Connecting and disconnecting the modem in Standalone mode e Defining a Ping Server e Adding firewall policies for modem connections Selecting a modem mode The external modem when connected to the FortiGate 60 can work in one of two modes depending on your requirements redundant mode e standalone mode Redundant mode configuration The redundant modem interface in redundant mode backs up a selected ethernet interface If that ethernet interface disconnects from its network the modem automatically dials the configured dialup account s When the modem connects to a dialup account the FortiGate unit routes IP packets normally destined for the selected ethernet interface to the modem interface During this time the unit pings the ethernet connection to check when it is back online When the ethernet interface can connect to its network again the FortiGate unit disconnects the modem interface and switches back to the ethernet interface FortiGate 60 Installation Guide 01 28008 0018 20050128 55 Selecting a modem mode 56 Configuring the modem interface For the FortiGate unit to switch from an ethernet interface to the modem you must select the name of the interface in the modem configuration and configure a pin
41. ge 28 To set the static IP address and netmask enter config system interface edit wanl set mode static set ip lt address ip gt lt netmask gt end Example config system interface edit wanl set mode static set ip 204 23 1 5 255 255 255 0 end To set the WAN1 interface to use DHCP enter config system interface edit wanl set mode dhcp end To set the WAN1 interface to use PPPoE enter config system interface edit wanl set mode pppo set connection enable set username lt name str gt set password lt passwrd gt end Use the same syntax to set the IP address of each FortiGate interface as reguired Confirm that the addresses are correct Enter get system interface The CLI lists the IP address netmask and other settings for each of the FortiGate interfaces 01 28008 0018 20050128 31 Using the setup wizard NA T Route mode installation To configure DNS server settings Set the primary and secondary DNS server IP addresses Enter config system dns set primary lt address ip gt set secondary lt address ip gt end Example config system dns set primary 293 44 75 21 set secondary 293 44 75 22 end To add a default route Add a default route to configure where the FortiGate unit sends traffic that should be sent to an external network usually the Internet Adding the default route also defines which interface is connected to an external network The default route is not reguired if the in
42. get the same virtual MAC address This virtual MAC address is set according to the group ID Group ID MAC Address 0 00 09 0f 06 ff 00 00 09 0f 06 ff 01 1 2 00 09 0f 06 ff 02 3 00 09 0f 06 ff 03 63 00 09 0f 06 ff 3f If you have more than one HA cluster on the same network each cluster should have a different group ID If two clusters on the same network have same group ID the duplicate MAC addresses cause addressing conflicts on the network Unit priority Override Master The unit with the highest priority becomes the primary unit in the cluster The unit priority range is 0 to 255 The default unit priority is 128 Set the unit priority to a higher value if you want the FortiGate unit to be the primary cluster unit Set the unit priority to a lower value if you want the FortiGate unit to be a subordinate unit in the cluster If all units have the same priority the FortiGate unit with the highest serial number becomes the primary cluster unit You can configure a FortiGate unit to always become the primary unit in the cluster by giving it a high priority and by selecting Override master 01 28008 0018 20050128 Fortinet Inc High availability installation Configuring FortiGate units for HA operation Table 10 High availability settings Continued Schedule The schedule controls load balancing among the FortiGate units in the active active HA cluster The schedul
43. he cluster to your networks FortiGate 60 Installation Guide Use the following procedure to connect a cluster operating in NAT Route mode or Transparent mode Connect the FortiGate units in the cluster to each other and to your network You must connect all matching interfaces in the cluster to the same hub or switch Then you must connect these interfaces to their networks using the same hub or switch Fortinet recommends using switches for all cluster connections for the best performance 01 28008 0018 20050128 51 Connecting the cluster to your networks High availability installation Inserting an HA cluster into your network temporarily interrupts communications on the network because new physical connections are being made to route traffic through the cluster Also starting the cluster interrupts network traffic until the individual FortiGate units in the cluster are functioning and the cluster completes negotiation Cluster negotiation normally takes just a few seconds During system startup and negotiation all network traffic is dropped To connect the cluster 1 Connect the cluster units Connect the internal interfaces of each FortiGate unit to a switch or hub connected to your internal network Connect the WAN1 interfaces of each FortiGate unit to a switch or hub connected to your external network e Connect the DMZ interfaces of the FortiGate units to another switch or hub By default the DMZ interfaces are used fo
44. hutDown select Shut Down and select Apply or from the CLI enter execute shutdown Disconnect the power supply 01 28008 0018 20050128 15 Connecting to the web based manager Getting started Connecting to the web based manager 16 4 Use the following procedure to connect to the web based manager for the first time Configuration changes made with the web based manager are effective immediately without resetting the firewall or interrupting service To connect to the web based manager you need e a computer with an ethernet connection Internet Explorer version 6 0 or higher e an ethernet cable Note You can use the web based manager with recent versions of most popular web browsers The web based manager is fully supported for Internet Explorer version 6 0 or higher To connect to the web based manager Set the IP address of the computer with an ethernet connection to the static IP address 192 168 1 2 with a netmask of 255 255 255 0 You can also configure the management computer to obtain an IP address automatically using DHCP The FortiGate DHCP server assigns the management computer an IP address in the range 192 168 1 1 to 192 168 1 254 Using the ethernet cable connect the internal interface of the FortiGate unit to the computer ethernet connection Start Internet Explorer and browse to the address https 192 168 1 99 remember to include the s in https The FortiGate login is displayed Fig
45. ials and select the FortiGate interface that the modem is redundant for Figure 13 Modem settings Standalone and Redundant W Enable Modem modem status not active Mode Dial Now JV Enable Modem modem status not active standalone Redundant Mode Standalone Redundant T Auto dial Redundant for wan w F pial on demand Idle timeout 5 minutes Holddown Timer 60 1 60 seconds Redial Limit none z Redial Limit None z Dialup Account 1 7 Dialup Account 1 9 Phone Number 6135552112 Phone Number 6135552112 User Name squire User Name squire Password Password Dialup Account 2 Dialup Account 2 Phone Number Phone Number User Name User Name Password Password Dialup Account 3 Dialup Account 3 Phone Number Phone Number User Name User Name Password Password Apply d Apply Enable Modem or Enable USB Modem Modem status Dial Now Hang Up Mode Auto dial Redundant for 01 28008 0018 20050128 Select to enable the FortiGate modem Depending on the model the modem is internal or it is a USB connected external modem The modem status shows one of not active connecting connected disconnecting or hung up Standalone mode only Standalone mode only Select Dial Now to manually connect to a dialup account If the modem is connected you can select Hang Up to manually disconnect the modem Select Standalone or Redundant mode In Standalone mode the modem is an independent inte
46. ically adjust clock for daylight saving changes check box Select Set Time and set the FortiGate system date and time Set the hour minute second month day and year as reguired Select Apply To use NTP to set the FortiGate date and time Go to System gt Config gt Time Select Synchronize with NTP Server to configure the FortiGate unit to use NTP to automatically set the system time and date Enter the IP address or domain name of the NTP server that the FortiGate unit can use to set its time and date Specify how often the FortiGate unit should synchronize its time with the NTP server Select Apply To register your FortiGate unit After purchasing and installing a new FortiGate unit you can register the unit by going to the System Update Support page or using a web browser to connect to http support fortinet com and selecting Product Registration To register enter your contact information and the serial numbers of the FortiGate units that you or your organization have purchased You can register multiple FortiGate units in a single session without re entering your contact information To configure virus attack and spam definition updates You can configure the FortiGate unit to automatically keep virus grayware and attack definitions up to date 01 28008 0018 20050128 45 Next steps 46 Transparent mode installation Go to System gt Maintenance gt Update Center Select Refresh to test the FortiGate unit
47. iguring the modem you must set Redundant for to the name of the ethernet interface that the modem interface replaces You must also configure firewall policies for connections between the modem interface and other FortiGate interfaces Note Do not add a default route to the ethernet interface that the modem interface replaces Note Do not add firewall policies for connections between the ethernet interface that the modem replaces and other interfaces To operate in standalone mode Go to System gt Network gt Modem From the Redundant for list select the ethernet interface that the modem is replacing 01 28008 0018 20050128 Fortinet Inc Configuring the modem interface Configuring modem settings Configure other modem settings as reguired See Configuring modem settings on page 57 Make sure there is correct information in one or more Dialup Accounts Configure firewall policies for connections to the modem interface See Adding firewall policies for modem connections on page 60 Select Dial Up The FortiGate unit initiates dialing into each dialup account in turn until the modem connects to an ISP Configuring modem settings FortiGate 60 Installation Guide Configure modem settings so that the FortiGate unit uses the modem to connect to your ISP dialup accounts You can configure the modem to connect to up to three dialup accounts You can also enable and disable FortiGate modem support configure what the modem d
48. k gt Management Set Default Gateway to the default gateway IP address that you recorded in Table 9 on page 40 Select Apply Reconnecting to the web based manager If you changed the IP address of the management interface while you were using the setup wizard you must reconnect to the web based manager using the new IP address Browse to https followed by the new IP address of the management interface Otherwise you can reconnect to the web based manager by browsing to https 10 10 10 1 If you connect to the management interface through a router make sure that you have added a default gateway for that router to the management IP default gateway field Using the command line interface FortiGate 60 Installation Guide As an alternative to the web based manager or setup wizard you can begin the initial configuration of the FortiGate unit using the command line interface CLI To connect to the CLI see Connecting to the command line interface CLI on page 17 Use the information that you gathered in Table 9 on page 40 to complete the following procedures To change to Transparent mode using the CLI Make sure that you are logged into the CLI Switch to Transparent mode Enter config system global set opmode transparent end The FortiGate unit restarts After a few seconds the login prompt appears Type admin and press Enter The following prompt appears Welcome Confirm that the FortiGate unit has switched to
49. mpt is displayed FortiGate 60 login Type admin and press Enter twice The following prompt is displayed Welcome Type to list available commands For information about how to use the CLI see the FortiGate CLI Reference Guide 01 28008 0018 20050128 17 Quick installation using factory defaults Getting started Quick installation using factory defaults 18 You can quickly set up your FortiGate unit for a home or small office using the web based manager and the factory default FortiGate configuration All you need to do is set your network computers to obtain an IP address automatically and to obtain DNS server IP addresses automatically using DHCP access the web based manager and configure the required settings for the FortiGate WAN1 interface You can also configure FortiGate DNS servers and add a FortiGate default route if needed The FortiGate internal interface acts as a DHCP server for the internal network automatically assigning IP addresses to up to 100 computers in the range 192 168 1 110 192 168 1 210 Figure 4 Quick configuration using default settings FortiGate 60 Unit i Internal network Internet i a o a are E WAN interface Internal interface Configure Manual IP DHCP or 192 168 1 99 PPPOE addressing DHCP server and DNS server j for the internal network Obtain IP address and DNS server IP address automatically The Fortigate DHCP server also assigns the DNS server IP address 192 168 1
50. ncing according to IP address If the FortiGate units are connected using switches select IP to distribute traffic to units in a cluster based on the Source IP and Destination IP of the packet IP Port Load balancing according to IP address and port If the FortiGate units are connected using switches select IP Port to distribute traffic to units in a cluster based on the Source IP Source Port Destination IP and Destination port of the packet Configuring FortiGate units for HA using the web based manager FortiGate 60 Installation Guide Use the following procedure to configure each FortiGate unit for HA operation To change the FortiGate unit host name Changing the host name is optional but you can use host names to identify individual cluster units Power on the FortiGate unit to be configured Connect to the web based manager See Connecting to the web based manager on page 16 Go to System gt Status In the Host Name field of the Unit Information section select Change Type a new host name and select OK 01 28008 0018 20050128 49 Configuring FortiGate units for HA operation High availability installation 50 O ON O a AK WO N 10 11 12 13 14 15 16 To configure a FortiGate unit for HA operation Go to System gt Config gt HA Select High Availability Select the mode Select a Group ID for the HA cluster If reguired change the Unit Priority If reguired
51. necting the FortiGate unit to the NetWork S u lt lt lt lt lt lt lt lt lt zrr 34 Configuring the networks 2 2 cci ccc ee ccane eee tencebeeheddecenned edeeeebineddeeebieeddeecanbeiedeeeeneandede 36 Configuring the Modem interface c cccccceceecccceeeseeceeeeeeeeaaeeeeeeeaaaneeeesenaaneneneeaaneaeeneeas 36 Next Steps oiri ea i a i aa a neg indioa anadesdetseausdeastagaeaudcanneedees 36 Transparent mode installation ccccceceeeeeeeeeeeeeeeeeeeeeneeseeeeeeeeeeeeeeeseeeeeeeenaes 39 Preparing to configure Transparent mode een 39 Using the web based Manager 24 22 24e 2222000 eee eee eeeteeeeeetieeeeeeeaeeeeeenea 40 Reconnecting to the web based manager een 41 Using the command line interfaCe e lt ee e eeeeeee ee ee eee a a 41 Using the Setup Wizard eisrean pos Seeleali E 43 Reconnecting to the web based manager eee 43 Connecting the FortiGate unit to your network u eee eee 44 Next SIC DSi zsz 2u z slad ra degeeeed aaa ak nana tee ad euch VE a hod dan sane dada desea talek 45 Might availability installatio M si ui zda k kua ak kl d bisk ndajaskes k 47 Priorities of heartbeat device and monitor priorities 2 ereeeee 47 Configuring FortiGate units for HA Operation lt lt lt lt lt lt lt 47 High availability configuration settings een 47 Configuring FortiGate units for HA using the we
52. network configuration 21 Factory default firewall Configuration lt 4 e422eeeeeee0eeeeeee00 ee eeee eee eee nn 21 Factory default protection profileS 2 e2ee2eeeeeeeeeee0e000e0 eee eee ena n n ennenen 22 Planning the FortiGate Configuration lt lt lt vre 23 NAT Route MOJE isunki een eared nde an dade dda deg asad 23 NAT Route mode with multiple external network connections eee 24 Transparent Modessa ied cae ccahcacecnsuuasdcanseeecdexeacnddacueausaadevencnapd OU o a uo KA da 25 CONTQUFATION OPUlONS se sues cee cotta ct eee a hu dua nvk tl abs dona ees 26 Next stepS NA 26 NAT Route mode installation lt lt lt lt lt essr rrreeeeeeseeeeeee eee aan ee eee een nnna 27 Preparing to configure the FortiGate unit in NAT Route Mode ee 27 DHCP or PPPOE configuration eee eeee eee nene 28 Using the web based manager ccccccccceceeccccceeeeecceeeeeeseecaeeeeeeeeaaaeeeeseeacaeeeeseeaaaeeneteeaee 28 Coniiguring basic Segs ernn aAa E SEN E A 29 FortiGate 60 Installation Guide 01 28008 0018 20050128 Contents Contents Using the command line iNterface eee eee nene ennn 30 Configuring the FortiGate unit to operate in NAT Route mode ee 30 Using the setup Wiza suc occ zgodny niekoho on keds a pikle o vody o er cn ve A dn nedat 32 Starting the Setup Wizard occ cee iaeei e nenea a A AEAEE NAERA EEEE Naaa 34 Con
53. ngs that you can configure with the setup wizard See Table 6 on page 28 and Table 7 on page 28 for other settings Table 8 Setup wizard settings Password Prepare an administrator password Internal Interface Use the information you gathered in Table 6 on page 28 Use the information you gathered in Table 6 on page 28 External Interface The External interface in the setup wizard refers to the WAN1 interface of the FortiGate unit Starting IP Ending IP Netmask DHCP server Default Gateway DNS IP Your FortiGate firewall contains a DHCP server to automatically set up the addresses of computers on your internal network Web Server SMTP Server POP3 Server Internal servers IMAP Server FTP Server If you provide access from the Internet to a web server SMTP server POP3 server IMAP server or FTP server installed on an internal network add the IP addresses of the servers here 01 28008 0018 20050128 33 Connecting the FortiGate unit to the network s NAT Route mode installation Table 8 Setup wizard settings High Create a protection profile that enables virus scanning file blocking and blocking of oversize email for HTTP FTP IMAP POP3 and SMTP Add this protection profile to a default firewall policy m Medium Create a protection profile that enables virus Antivirus scanning for HTTP FTP IMAP POP3 and SMTP
54. nit you can add firewall policies See the FortiGate Administration Guide for information about adding firewall policies The following firewall configuration settings are included in the default firewall configuration to make it easier to add firewall policies FortiGate 60 Installation Guide 01 28008 0018 20050128 21 Factory default FortiGate configuration settings Getting started Table 5 Default firewall configuration Configuration setting Name Description Firewall policy Internal gt Wan1 Source All Destination All Firewall address All Firewall address matches the source or destination address of any packet Pre defined service More than 50 Select from any of the 50 pre defined services predefined services to control traffic through the FortiGate unit that uses that service Recurring schedule Always The recurring schedule is valid at any time Protection Profiles Strict Scan Web Control how the FortiGate unit applies virus Unfiltered scanning web content filtering spam filtering and IPS The factory default firewall configuration is the same in NAT Route and Transparent mode Factory default protection profiles Use protection profiles to apply different protection settings for traffic that is controlled by firewall policies You can use protection profiles to e Configure antivirus protection for HTTP FTP IMAP POP3 and SMTP firewall policies e Configure Web filterin
55. nnecting to the command line interface CLI Quick installation using factory defaults Factory default FortiGate configuration settings Planning the FortiGate configuration Next steps 01 28008 0018 20050128 13 Package contents Getting started Package contents The FortiGate 60 package contains the following items FortiGate 60 Antivirus Firewall one orange crossover ethernet cable Fortinet part number CC300248 one gray regular ethernet cable Fortinet part number CC300249 one RJ 45 to DB 9 modem cable Fortinet part number CC300302 FortiGate 60 Quick Start Guide CD containing the FortiGate user documentation one power cable and AC adapter Figure 2 FortiGate 60 package contents Front Ethernet Cables ERIS M Orange Crossover STATUS 1 2 3 4 DMZ wam WAN Grey Straight through 0E 00 0E 0 oo oo oo D LINK100 LINK100 LINK100 LINK100 LINK100 LINK100 LINK 100 m A RJ 45 to DB 9 Serial Cable Power Status Internal DMZ WAN 1 2 LED LED Interface Interface Interface Back Power Cable Power Supply x DC 12V a E EE WAN2 DMZ Power Documentation Connection USB WAN1 Internal Interface switch connectors RJ 45 Serial Connection Mounting The FortiGate 60 unit can be installed on any stable surface Make sure that the unit has at least 1 5 in 3 75 cm of clearance on each side to allow for adequate air flow and cooling Dimensions 8 63 x 6 13 x 1 38 in 21 9 x 15 6 x 3 5 cm W
56. nterface to the Internet Connect to the public switch or router usually provided by a different Internet Service Provider If you are a DSL or cable subscriber connect the WAN2 interface to the internal or LAN connection of your DSL or cable modem Optionally connect the DMZ interface to your DMZ network You can use a DMZ network to provide access from the Internet to a web server or other server without installing the servers on your internal network Figure 10 FortiGate 60 NAT Route mode connections DMZ Network Internal Network Web Server Mail Server Wireless Network DMZ Internal FortiGate 60 WAN1 WAN2 T1 Broadband cable or DSL 01 28008 0018 20050128 35 Configuring the networks NAT Route mode installation Configuring the networks If you are running the FortiGate unit in NAT Route mode your networks must be configured to route all Internet traffic to the IP address of the FortiGate interface to which they are connected For the internal network change the default gateway address of all computers and routers connected directly to your internal network to the IP address of the FortiGate internal interface e For the DMZ network change the default gateway address of all computers and routers connected directly to your DMZ network to the IP address of the FortiGate DMZ interface e For the external network route all packets to the FortiGate WAN1 or WAN 2 interface If you are using the
57. ortiGate Administration Guide Provides basic information about how to configure a FortiGate unit including how to define FortiGate protection profiles and firewall policies how to apply intrusion prevention antivirus protection web content filtering and spam filtering and how to configure a VPN FortiGate online help Provides a context sensitive and searchable version of the Administration Guide in HTML format You can access online help from the web based manager as you Work FortiGate CLI Reference Guide Describes how to use the FortiGate CLI and contains a reference to all FortiGate CLI commands FortiGate Log Message Reference Guide Describes the structure of FortiGate log messages and provides information about the log messages that are generated by FortiGate units FortiGate High Availability Guide Contains in depth information about the FortiGate high availability feature and the FortiGate clustering protocol 01 28008 0018 20050128 Fortinet Inc Introduction Related documentation FortiGate IPS Guide Describes how to configure the FortiGate Intrusion Prevention System settings and how the FortiGate IPS deals with some common attacks FortiGate VPN Guide Explains how to configure VPNS using the web based manager Fortinet Knowledge Center The most recent Fortinet technical documentation is available from the Fortinet Knowledge Center The knowledge center contains short how to articles FAQs technical
58. r HA heartbeat communications These interfaces should be connected together for the HA cluster to function e Optionally connect the WAN2 interface of each FortiGate unit to a switch or hub connected a second external network Figure 12 HA network configuration Internal Network Internal WAN1 KEE m RU Hub or DMZ Hub or Switch Switch o m IE a 4 Router Internet 52 01 28008 0018 20050128 Fortinet Inc High availability installation Installing and configuring the cluster Power on all the FortiGate units in the cluster As the units start they negotiate to choose the primary cluster unit and the subordinate units This negotiation occurs with no user intervention and normally just takes a few seconds Installing and configuring the cluster FortiGate 60 Installation Guide When negotiation is complete the you can configure the cluster as if it was a single FortiGate unit e Ifyou are installing a NAT Route mode cluster use the information in NAT Route mode installation on page 27 to install the cluster on your network e Ifyou are installing a Transparent mode cluster use the information in Transparent mode installation on page 39 to install the cluster on your network The configurations of all of the FortiGate units in the cluster are synchronized so that the FortiGate units can function as a cluster Because of this synchronization you configure and manage the HA
59. rface In Redundant mode the modem is a backup facility for a selected Ethernet interface Standalone mode only Select to dial the modem automatically if the connection is lost or the FortiGate unit is restarted You cannot select Auto dial if Dial on demand is selected Redundant mode only Select the ethernet interface for which the modem provides backup service 57 Connecting and disconnecting the modem in Standalone mode Configuring the modem interface a RB G N gt Dial on demand Standalone mode only Select to dial the modem when packets are routed to the modem interface The modem disconnects after the idle timeout period You cannot select Dial on demand if Auto dial is selected Idle timeout Standalone mode only Enter the timeout duration in minutes After this period of inactivity the modem disconnects Holddown Redundant mode only Enter the time 1 60 seconds that the Timer FortiGate unit waits before switching from the modem interface to the primary interface after the primary interface has been restored The default is 1 second Configure a higher value if you find the FortiGate unit switching repeatedly between the primary interface and the modem interface Redial Limit The maximum number of times 1 10 that the FortiGate unit modem attempts to reconnect to the ISP if the connection fails The default redial limit is 1 Select None to have no limit on redial attempts Dialup Account Configure up to thr
60. rface For security reasons you should enter a password for the Virtual Doman pree osta ta Keke to a Make sure that it is difficult for others R Router moe hone Firmwrare Version Fortigate 100 2 f The password can contain numbers 0 9 and uppercase R Firewan peroane 4 321 07 07 2004 and lowercase letters A Z a z but no spaces Definitions F user Attack Definitione 2 104 05 05 2004 ean Serial Number FG Change password Operation Mode N gt nation J irs Recent Virus Detections T Anti virus Time Sre Dst I Web Filter Wo virus detected Spam Filter Log amp Report EiFoanner _Sivup 0 Days 23 Hours REAL TIME NETWORK PROTECTION Command line interface You can access the FortiGate command line interface CLI by connecting a management computer serial port to the FortiGate RS 232 serial console connector You can also use Telnet or a secure SSH connection to connect to the CLI from any network that is connected to the FortiGate unit including the Internet The CLI supports the same configuration and monitoring functionality as the web based manager In addition you can use the CLI for advanced configuration options that are not available from the web based manager This Installation Guide contains information about basic and advanced CLI commands For a more complete description about connecting to and using the FortiGate CLI see the FortiGate CLI Reference Guide 6 01 28008 0018 20050128 Fortinet Inc Introduction Set
61. s connection to the external network fails 24 01 28008 0018 20050128 Fortinet Inc Getting started Planning the FortiGate configuration Otherwise security policy configuration is similar to a NAT Route mode configuration with a single Internet connection You would create NAT mode firewall policies to control traffic flowing between the internal private network and the external public network usually the Internet If you have multiple internal networks such as one or more DMZ networks in addition to the internal private network you can create route mode firewall policies for traffic flowing between them Figure 7 Example NAT Route multiple internet connection configuration FortiGate 60 Unit WAN1 in NAT Route mode 204 23 1 5 Internal network Internet a wng T L o o os DEEN 192 168 1 3 e WAN2 Internal 64 83 32 45 192 168 1 1 NAT mode policies controlling traffic between internal and external networks Transparent mode FortiGate 60 Installation Guide In Transparent mode the FortiGate unit is invisible to the network Similar to a network bridge all FortiGate interfaces must be on the same subnet You only have to configure a management IP address so that you can make configuration changes The management IP address is also used for antivirus and attack definition updates You typically use the FortiGate unit in Transparent mode on a private network behind an existing firewall or behind a router
62. sses and is only a few steps away from protecting your network There are several ways to configure basic FortiGate settings e the web based manager the command line interface CLI or e the setup wizard 01 28008 0018 20050128 5 Secure installation configuration and management Introduction The CLI or the web based manager can then be used to complete configuration and to perform maintenance and administration Web based manager Using HTTP or a secure HTTPS connection from any computer running Internet Explorer you can configure and manage the FortiGate unit The web based manager supports multiple languages You can configure the FortiGate unit for HTTP and HTTPS administration from any FortiGate interface You can use the web based manager to configure most FortiGate settings You can also use the web based manager to monitor the status of the FortiGate unit Configuration changes made using the web based manager are effective immediately without resetting the firewall or interrupting service Once you are satisfied with a configuration you can download and save it The saved configuration can be restored at any time Figure 1 FortiGate web based manager and setup wizard FORTIGATE CONFIG Status Session Automatic Refresh Inter Fj Fortinet Firowall Sotup Wizard Microsoft Internet Explorer System Status UP Time Sune na a password Set The Administration Password Log Disk Not sva nce gt te
63. t between your internal network and the Internet The following network connections are available on the FortiGate 60 unit A 4 port switch for connecting the FortiGate internal interface to your internal network One WAN1 port for connecting to your public switch or router and the Internet One WAN2 port for connecting to a second public switch or router and the Internet for a redundant Internet connection 01 28008 0018 20050128 Fortinet Inc NAT Route mode installation FortiGate 60 Installation Guide Connecting the FortiGate unit to the network s One DMZ port for connecting to a DMZ network e Modem is the interface for connecting an external modem to the FortiGate 60 See Configuring the Modem interface on page 36 Note You can also connect the WAN1 and WAN2 interfaces to different Internet connections to provide a redundant connection to the Internet To connect the FortiGate unit Connect the Internal interface connectors to PCs and other network devices in your internal network The Internal interface functions as a switch allowing up to four devices to be connected to the internal network and the internal interface Connect the WAN1 interface to the Internet Connect to the public switch or router provided by your Internet Service Provider If you are a DSL or cable subscriber connect the WAN interface to the internal or LAN connection of your DSL or cable modem Optionally connect the WAN2 i
64. terface connected to the external network is configured using DHCP or PPPOE e Set the default route to the Default Gateway IP address Enter config router static edit 1 set dst 0 0 0 0 0 0 0 0 set gateway lt gateway IP gt set device lt interface gt end Example If the default gateway IP is 204 23 1 2 and this gateway is connected to WAN1 config router static edit 1 set dst 0 0 0 0 0 0 0 0 set gateway 204 23 1 2 set device wanl end Using the setup wizard From the web based manager you can use the setup wizard to complete the initial configuration of the FortiGate unit For information about connecting to the web based manager see Connecting to the web based manager on page 16 32 01 28008 0018 20050128 Fortinet Inc NAT Route mode installation FortiGate 60 Installation Guide Using the setup wizard If you are configuring the FortiGate unit to operate in NAT Route mode the default you can use the setup wizard to add the administration password configure the internal interface address choose either a manual static or a dynamic DHCP or PPPoE address for the external interface add a default route for the external interface add the DNS server IP addresses add the DHCP server settings and IP addresses add various internal server IP addresses including web IMAP POP3 SMTP and FTP servers set the antivirus protection to high medium or none Table 8 on page 33 lists the additional setti
65. to the external firewall or router Connect to the public switch or router provided by your Internet Service Provider If you are a DSL or cable subscriber connect the WAN interface to the internal or LAN connection of your DSL or cable modem Optionally connect the WAN2 and DMZ interfaces to other networks Figure 11 FortiGate 60 Transparent mode connections Internal Network Other Network Hub or Switch DMZ Internal ae Hub or Switch FortiGate 60 WAN1 Public Switch or Router Internet t 01 28008 0018 20050128 Fortinet Inc Transparent mode installation Next steps NO Ga K WO N gt FortiGate 60 Installation Guide Next steps You can use the following information to configure FortiGate system time to register the FortiGate unit and to configure antivirus and attack definition updates Refer to the FortiGate Administration Guide for complete information on configuring monitoring and maintaining your FortiGate unit To set the date and time For effective scheduling and logging the FortiGate system date and time must be accurate You can either manually set the system date and time or configure the FortiGate unit to automatically keep its time correct by synchronizing with a Network Time Protocol NTP server Go to System gt Config gt Time Select Refresh to display the current FortiGate system date and time Select your Time Zone from the list Optionally select Automat
66. up wizard Document conventions The FortiGate setup wizard provides an easy way to configure the basic initial settings for the FortiGate unit The wizard walks through the configuration of a new administrator password FortiGate interfaces DHCP server settings internal servers web FTP etc and basic antivirus settings Document conventions FortiGate 60 Installation Guide This guide uses the following conventions to describe command syntax Angle brackets lt gt to indicate variables For example xecute restore config lt filename str gt You enter xecute restore config myfile bak lt xxx str gt indicates an ASCII string that does not contain new lines or carriage returns lt xxx integer gt indicates an integer string that is a decimal base 10 number lt xxx octet gt indicates a hexadecimal string that uses the digits 0 9 and letters A F lt xxx ipv4 gt indicates a dotted decimal IPv4 address lt xxx_v4mask gt indicates a dotted decimal IPv4 netmask lt xxx_ipv4mask gt indicates a dotted decimal IPv4 address followed by a dotted decimal IPv4 netmask lt xxx ipv6 gt indicates a dotted decimal IPv6 address lt xxx_v mask gt indicates a dotted decimal IPv6 netmask lt xxx ipv6 mask gt indicates a dotted decimal IPv6 address followed by a dotted decimal IPv6 netmask Vertical bar and curly brackets to separate alternative mutually exclusive required keywords For example s
67. up wizard provides easy fast configuration of the most basic settings to get the unit up and running quickly See Using the setup wizard on page 32 The method that you choose depends on the complexity of the configuration access and equipment and the type of interface you are most comfortable using 01 28008 0018 20050128 27 Using the web based manager NA T Route mode installation Table 6 NAT Route mode settings Administrator Password IP Internal Netmask IP WAN1 Netmask IP WAN2 Netmask IP DMZ Netmask Default Gateway Interface connected to external network usually wan1 A default route consists of a default gateway and the name of the interface connected to the external network usually the Internet The default gateway directs all non local traffic to this interface and to the external network Network settings Primary DNS Server Secondary DNS Server DHCP or PPPOE configuration You can configure any FortiGate interface to acquire its IP address from a DHCP or PPPoE server Your ISP may provide IP addresses using one of these protocols To use the FortiGate DHCP server you need to configure an IP address range and default route for the server No configuration information is reguired for interfaces that are configured to use DHCP PPPoE requires you to supply a user name and password In a
68. ure 3 FortiGate login Password Losin Type admin in the Name field and select Login 01 28008 0018 20050128 Fortinet Inc Getting started Connecting to the command line interface CLI Connecting to the command line interface CLI ee FortiGate 60 Installation Guide As an alternative to the web based manager you can install and configure the FortiGate unit using the CLI Configuration changes made with the CLI are effective immediately without resetting the firewall or interrupting service To connect to the FortiGate CLI you need a computer with an available communications port e the RJ 45 to DB9 cable included in your FortiGate package e terminal emulation software such as HyperTerminal for Windows Note The following procedure describes how to connect to the CLI using Windows HyperTerminal software You can use any terminal emulation program To connect to the CLI Connect the null modem cable to the communications port of your computer and to the FortiGate Console port Make sure that the FortiGate unit is powered on Start HyperTerminal enter a name for the connection and select OK Configure HyperTerminal to connect directly to the communications port on your computer and select OK Select the following port settings and select OK Bits per second 9600 Data bits 8 Parity None Stop bits 1 Flow control None Press Enter to connect to the FortiGate CLI The following pro
69. using the default settings NAT Route mode FortiGate 60 Installation Guide In NAT Route mode the FortiGate unit is visible to the network Like a router all its interfaces are on different subnets The following interfaces are available in NAT Route mode e Internal is the interface to the internal network e WAN is the default interface to the external network usually the Internet e WAN2 is the redundant interface to the external network e DMZ is the interface to the DMZ network Modem is the interface for connecting an external modem to the FortiGate 60 See Configuring the modem interface on page 55 01 28008 0018 20050128 23 Planning the FortiGate configuration Getting started You must configure routing to support the redundant WAN1 and WAN2 internet connections Routing can be used to automatically redirect connections from an interface if its connection to the external network fails You can add firewall policies to control whether communications through the FortiGate unit operate in NAT or Route mode Firewall policies control the flow of traffic based on the source address destination address and service of each packet In NAT mode the FortiGate unit performs network address translation before it sends the packet to the destination network In Route mode there is no address translation You typically use NAT Route mode when the FortiGate unit is operating as a gateway between private and public networks
70. ute Select Create New Set Destination IP to 0 0 0 0 Set Mask to 0 0 0 0 Set Gateway to the default gateway IP address Set Device to the interface connected to the external network Select OK Using the command line interface You can also configure the FortiGate unit using the command line interface CLI For information about connecting to the CLI see Connecting to the command line interface CLI on page 17 Configuring the FortiGate unit to operate in NAT Route mode 30 Use the information that you gathered in Table 6 on page 28 to complete the following procedures To add change the administrator password Log in to the CLI Change the admin administrator password Enter config system admin edit admin set password lt psswrd gt end To configure interfaces Log in to the CLI Set the IP address and netmask of the internal interface to the internal IP address and netmask that you recorded in Table 6 on page 28 Enter config system interface edit internal set mode static set ip lt address ip gt lt netmask gt end 01 28008 0018 20050128 Fortinet Inc NAT Route mode installation FortiGate 60 Installation Guide Using the command line interface Example config system interface edit internal set mode static set ip lt 192 168 120 99 gt lt 255 255 255 0 gt end Set the IP address and netmask of the WAN1 interface to the IP address and netmask that you recorded in Table 6 on pa
71. virus and attack definition updates and registering the FortiGate unit The factory default firewall configuration includes a single network address translation NAT policy that allows users on your internal network to connect to the external network and stops users on the external network from connecting to the internal network You can add more firewall policies to provide more control of the network traffic passing through the FortiGate unit The factory default protection profiles can be used to apply different levels of antivirus protection web content filtering spam filtering and IPS to the network traffic that is controlled by firewall policies e Factory default DHCP server configuration e Factory default NAT Route mode network configuration e Factory default Transparent mode network configuration e Factory default firewall configuration e Factory default protection profiles Factory default DHCP server configuration Using the factory default DHCP server settings you can quickly configure the internal network and the FortiGate unit See Quick installation using factory defaults on page 18 FortiGate 60 Installation Guide 01 28008 0018 20050128 19 Getting started Factory default FortiGate configuration settings 20 Table 2 FortiGate DHCP Server default configuration Name internal dhcp server Interface Internal 192 168 1 99 Default Gateway IP Range 192 168 1 110 192 168 1 210
72. y for default route 192 168 100 1 Interface connected to external network wan1 for default route Default Route A default route consists of a default gateway and the name of Network Settings the interface connected to the external network usually the Internet The default gateway directs all non local traffic to this interface and to the external network Primary DNS Server 207 192 200 1 Secondary DNS Server 207 192 200 129 Factory default Transparent mode network configuration In Transparent mode the FortiGate unit has the default network configuration listed in Table 4 Table 4 Factory default Transparent mode network configuration Administrator User name admin account Password none IP 10 10 10 1 Management IP Netmask 255 255 255 0 DNE Primary DNS Server 207 194 200 1 Secondary DNS Server 207 194 200 129 Internal HTTPS Ping WAN1 Ping Administrative access WAN2 Ping DMZ HTTPS Ping Factory default firewall configuration FortiGate firewall policies control how all traffic is processed by the FortiGate unit Until firewall policies are added no traffic can be accepted by or pass through the FortiGate unit The factory default configuration contains one firewall policy that allows all traffic originating on the internal network to access the Internet No other traffic is allowed through the FortiGate unit To allow traffic through the FortiGate u
73. zard OSNOVA 7 Document CONVENTIONS sesecsccrineniniccrieii i a n A 7 FortiGate documentation 2 eee eeceete eee eente eee e ete ee eee eee ee eee teaeee eee esaeeeeeeeaaeeeeseenaeeeseeenaaes 8 Fortinet Knowledge Center cccccccccccceeseeeccneeeeeeeececeseenenenereeseeeceneeseseceeedesseeceeeeneneneede 9 Comments on Fortinet technical documentation eee 9 Related documentation xs a sieves asians O auiia nied aloes 9 FortiManager documentation eee eee nenene 9 FortiClient documentation 2 eee eee 0000 eee 0 nene hen 9 FortiMail documentation uz il uau zde oi k zste AE 10 FortiLkog dOCumentatlon sii erai peha s hook a A 10 Customer service and technical SUPPOSt c cccecceceeeeeeeeeeeeeecaeaeceeeeeeeeeseeeeesensnnaeeees 10 Getting Started ia ag tei ea eee tcc inti ec 13 Package COMONMS sinisini aia a A NE 14 MOUN NG aaa a a a e a a a a a a RKO AA NASA aA 14 Turning the FortiGate unit power on and Off eeeeeeeeeen 15 Connecting to the web based manager ssseesssssssesrsessssrnnanrinnnesssnnnaaatennaaanannnaattnnneananaa 16 Connecting to the command line interface CLI eee eee eee eeeeenn 17 Quick installation using factory defaults cee ee eeeeeeeeeeeee00 eee eee nn 18 Factory default FortiGate configuration settings eee 19 Factory default DHCP server Configuration eee 19 Factory default NAT Route mode network configuration 20 Factory default Transparent mode

Download Pdf Manuals

Related Search

Related Contents

Interface Meter Operating Instructions  Siemens KG29FA40 fridge-freezer  Zanussi DE 4554 S Instruction Manual  Perl`Oleo_parquets - FT_A5R.ai  Industrial Electrical Engineering and Automation  Miniak-editor User Manual  Toshiba tw420  COMS B34 Syllabus - Bakersfield College  Haier W63A Notebook  Panaracer 軽量チューブシリーズの取扱上の注意点（2004.8.26）  

Copyright © All rights reserved. Failed to retrieve file