Fortinet 50b User Manual

Checking the Package Contents

Connecting

Planning the Configuration

WAN1 WAN2

POWER STATUS

INTERNAL

321

LINK / ACT

10/100

123

USB

WAN2 WAN1

DC+12V

WAN1 WAN2

POWER STATUS

INTERNAL

321

LINK / ACT

10/100

Power

Conne ction

RJ-45 Serial

Connection

USB

WAN2

WAN1

Power

LED

Statu s

LED

Inter nal I nterf ace,
switc h con necto rs

1,2,3

WAN 1, 2
Inter face

Inter nal

Inter face

Docume ntation

Straig ht-through

Ethern et cable

FortiGate-50B

Copyright 2006 Fortinet In corporated. All rights reserved.

Trademarks
Products mentioned in this document a re trademar ks.

Power Cable Power Supply

RJ-45 to

DB-9 S erial Cable

Qu ic k S ta r t G u id e

WAN1WAN2

POWER STATUS

INTERNAL

321

LINK / ACT

10/100

Back

Fron t

Ground

123

USB

WAN2 WAN1

DC+12V

Strai ght-throu gh Ethernet ca ble conne cts
to In ternet (p ublic switch o r router)

Strai ght-throu gh Ethernet ca bles conn ect

to co mputers o n internal net work

Power cable

conne cts to po wer supply

Optio nal redun dant connectio n to Inte rnet

RJ-45 to DB-9 serial cable
conne cts to ma nagement compu ter

Groun d

Inter net

Router

DMZ net

w

ork

Web Server

Mail Server

Int erna l

net work

Hub or switch

Port1

WAN1

Port 2

LED State Description

Intern et

Router

Int ernal

netw ork

Port 2

10.10.10.1

10.10.10.2

Int ernal Netwo rk

192.168.1.3

Port 1

192.168.1.99

Routing policies controlling

traffic between internal

networks.

WAN1

204.23.1.5

NAT mode policies controlling

traffic between internal

and external networks.

Power

Status

Link / Activity

10/100 Green The interface is connected at 100 Mbps.

Green The FortiGate unit is on.

Off The FortiGate unit is off.

Green On during start up or reboot.

Off Normal operation.

Green The correct cable is in use and the connected equip-

ment has power.

Flashing

Network activity at this interface.

Green

Off No link established.

© Copyright 2007 Fortinet Incorporated. All rights reserved.
Products mentioned in this document are trademarks or registered trade­marks of their respective holders.
Regulatory Compliance
FCC Class B Part 15 CSA/CUS
19 April 2007

FortiGate-50B

01-30003-0361-20070419

Connector Type Speed Protocol Description

Internal RJ-45 10/100 Base-T Ethernet 3-port switch connection to up to three devices or

the internal network.

WAN1 and

RJ-45 10/100 Base-T Ethernet Redundant connections to the Internet.

WAN 2

CONSOLE RJ-45 9600 bps RS-232

serial

Optional connection to the management computer.
Provides access to the command line interface
(CLI).

USB USB USB Optional connection for FortiUSB key for rmware

backup and installation.

Connect the FortiGate unit to a power outlet and to the internal and external networks.

Place the unit on a stable surface.

•

The FortiGate unit requires 1.5 inches (3.75 cm) clearance above and on each side to

•
allow for cooling.

The Status light is on while the unit is starting up and turns off when the system is up

•
and running.

Before beginning to congure the FortiGate unit, you need to plan how to integrate the unit into your network. Your conguration plan is dependent upon the operating mode that you select:

NAT/Route mode (the default) or Transparent mode.

Select one of the following Addressing modes

Quick conguration using the default settings

You can quickly set up your FortiGate unit for a home or small ofce using the web-based

manager and the default settings in NAT/Route mode.

All you need to do is set your network computers to use DHCP, access the web-based
manager, and congure the required settings for the WAN1 interface. You can also congure

DNS and a default route if needed. The FortiGate unit automatically assigns IP addresses to
up to 100 computers in the internal network.

1.

Connect the FortiGate unit to the network.

Set the all the network computers to use DHCP to automatically obtain an IP address.

2.
The FortiGate internal interface acts as a DHCP server for the internal network and as­signs IP addresses to all computers in the range 192.168.1.110 –192.168.1.210.

From the management computer browse to https://192.168.1.99. The FortiGate web-

3.
based manager appears.
Go to System > Network > Interface and select Edit for the WAN1 interface.

4.

NAT/Route mode

In NAT/Route mode, each FortiGate unit is visible to the network that it is connected to. All

of its interfaces are on different subnets. Each interface connected to a network must be

congured with an IP address that is valid for that network.
You would typically use NAT/Route mode when the FortiGate unit is deployed as a gateway
between private and public networks. In its default NAT/Route mode conguration, the unit

functions as a rewall. Firewall

policies control communications
through the FortiGate unit. No traf-

c can pass through the
FortiGate unit until you add rewall

policies.
In NAT/Route mode, rewall poli­cies can operate in NAT mode or

in Route mode. In NAT mode, the

FortiGate unit performs network
address translation before IP
packets are sent to the destina-

tion network. In Route mode, no

translation takes place.

Refer to the Tools and Documentation CD-ROM for information on how to control trafc, and how to congure HA, antivirus protection, FortiGuard, Web content ltering, Spam
ltering, intrusion prevention (IPS), and virtual private networking (VPN).

5.

Manual: enter a static IP address and netmask, select OK, and go to step 6

•

DHCP: to get an IP address from the ISP select DHCP and go to step 9

•

PPPoE: to get an IP address from the ISP select PPPoE and go to step 9

•
Go to System > Network > DNS.

6.
Select one of the following DNS settings

7.

Obtain DNS server address automatically: select to get the DNS addresses from the

•

ISP, select Apply
Use the following DNS server addresses: select and enter the DNS server address-

•

es given to you by the ISP, select Apply

Go to Router > Static, select Create New, enter the default gateway address and select

8.
OK. Network conguration is complete. Proceed to part 7 of this Quick Start Guide.
Select Retrieve default gateway from server and Override internal DNS options if your

9.
ISP supports them, select OK, and proceed to part 7 of this Quick Start Guide.

Go to step 6 if you are not selecting these options.

Transparent mode

In Transparent mode, the FortiGate unit is invisible to the network. All of its interfaces are on
the same subnet. You only have to congure a management IP address so that you can make
conguration changes.

You would typically use the FortiGate

unit in Transparent mode on a private

network behind an existing rewall or

behind a router. In its default Trans-

parent mode conguration, the unit
functions as a rewall. No trafc can

pass through the FortiGate unit until

you add rewall policies.
You can connect up to four network

segments to the FortiGate unit to

control trafc between these network

segments.

Completing the Configuration

7

Collecting Information

Configuring the FortiGate Unit

Choosing a Configuration Tool

Web-based manager

Command Line Interface (CLI)

The FortiGate web-based manager is an easy to use management tool.

Use it to congure the administrator password, the interface and default gateway addresses,

and the DNS server addresses.

Requirements:

An Ethernet connection between the FortiGate unit and management computer.

•
Internet Explorer 6.0 or higher on the management computer.

•

NAT/Route Mode

Internal Interface: IP: ____.____.____.____

Netmask: ____.____.____.____

WAN1 Interface:

WAN2 Interface IP: ____.____.____.____

The internal interface IP address and netmask must be valid for the internal network.

IP: ____.____.____.____

Netmask: ____.____.____.____

Netmask: ____.____.____.____

Transparent mode

Management IP: IP: ____.____.____.____

Netmask: ____.____.____.____

The management IP address and netmask must be valid for the network from which you will
manage the FortiGate unit.

The CLI is a full-featured management tool. Use it to congure the administrator password,
the interface addresses, the default gateway address, and the DNS server addresses. To
congure advanced settings, see the Tools and Documentation CD-ROM.

Requirements:

The RJ-45 to DB9 serial connection between the FortiGate unit and management com-

•
puter.

A terminal emulation application (HyperTerminal for Windows) on the management

•
computer.

General settings

Administrator password:

Network Settings: Default Gateway:

Primary DNS Server: ____.____.____.____

Secondary DNS Server: ____.____.____.____

A default gateway is required for the FortiGate unit to route connections to the Internet.

____.____.____.____

Factory default settings

NAT/Route mode Transparent mode

Internal interface 192.168.1.99 Management IP 0.0.0.0

WAN1 interface 192.168.100.99 Administrative account settings

WAN2 interface 192.168.101.99 User name admin

DHCP server on Internal

interface

192.168.1.110
– 192.168.1.210

Password (none)

Web-based Manager

Connect the FortiGate internal interface to a management computer Ethernet interface.

1.
Use a cross-over Ethernet cable to connect the devices directly. Use straight-through
Ethernet cables to connect the devices through a hub or switch.

Congure the management computer to be on the same subnet as the internal

2.

interface of the FortiGate unit. To do this, change the IP address of the management

computer to 192.168.1.2 and the netmask to 255.255.255.0.

To access the FortiGate web-based manager, start Internet Explorer and browse to

3.

https://192.168.1.99 (remember to include the “s” in https://).
Type admin in the Name eld and select Login.

4.

NAT/Route mode

To change the administrator password

Go to System > Admin > Administrators.

1.
Select Change Password for the admin administrator and enter a new password.

2.

To congure interfaces

Go to System > Network > Interface.

1.

Select the edit icon for each interface to congure.

2.
Set the addressing mode for the interface. (See the online help for information.)

3.

For manual addressing, enter the IP address and netmask for the interface.

•

For DHCP addressing, select DHCP and any required settings.

•

For PPPoE addressing, select PPPoE, and enter the username and password

•

and any other required settings.

To congure the Primary and Secondary DNS server IP addresses

Go to System > Network > Options, enter the Primary and Secondary DNS IP ad-

1.
dresses that you recorded above and select Apply.

To congure a Default Gateway

Go to Router > Static and select Edit icon for the static route.

1.

Set Gateway to the Default Gateway IP address you recorded above and select OK.

2.

Transparent mode

To reset the FortiGate unit to the factory defaults, in the CLI type the command
execute factory reset

Command Line Interface

Use the RJ-45 to DB9 serial cable to connect the FortiGate Console port to the man-

1.
agement computer serial port.

Start a terminal emulation program (HyperTerminal) on the management computer. Use

2.

these settings:
Baud Rate (bps) 9600, Data bits 8, Parity None, Stop bits 1, and Flow Control None.

3.

At the Login: prompt, type admin and press Enter twice (no password required).

4.

NAT/Route mode

Congure the FortiGate internal interface.

1.

cong system interface
edit internal
set ip <intf_ip>/<netmask_ip>

end

Repeat to congure each interface, for example, to congure the WAN1 interface.

2.

cong system interface
edit wan1

...

Congure the primary and secondary DNS server IP addresses.

3.

cong system dns
set primary <dns-server_ip>
set secondary <dns-server_ip>

end

Congure the default gateway.

4.

cong router static
edit 1
set gateway <gateway_ip>

end

To switch from NAT/route mode to transparent mode

Go to System > Cong > Operation Mode and select Transparent.

1.
Set the Management IP/Netmask to 192.168.1.99/24.

2.
Set a default Gateway and select Apply.

3.

To change the administrator password

Go to System > Admin > Administrators.

1.
Select Change Password for the admin administrator and enter a new password.

2.

To change the management interface

Go to System > Cong > Operation Mode.

1.
Enter the Management IP address and netmask that you recorded above and select

2.
Apply.

To congure the Primary and Secondary DNS server IP addresses

Go to System > Network > Options, enter the Primary and Secondary DNS IP ad-

1.
dresses that you recorded above and select Apply.

Congratulations!

You have nished conguring the basic settings. Your network is now protected from Internet­based threats. To explore the full range of conguration options, see the online help or the

Tools and Documentation CD-ROM.

Transparent Mode

Change from NAT/Route mode to Transparent mode and congure the Management IP

1.
address.

cong system settings
set opmode transparent
set manageip <mng_ip>/<netmask>
set gateway <gateway_ip>

end

Congure the DNS server IP address.

2.

cong system dns
set primary <dns-server_ip>
set secondary <dns-server_ip>

end

Visit these links for more information and documentation for your Fortinet product.

Technical Documentation - http://docs.forticare.com

•
Fortinet Knowledge Center - http://kc.forticare.com

•
Fortinet Technical Support - http://support.fortinet.com

•