Fortinet 800F, 800 User Manual

FortiGate 800/800F

Installation Guide

FortiGate-800

INTERNAL

Esc Enter

EXTERNAL DMZ HA 123

PWR

CONSOLE

4 USB

FortiGate-800F

PWR

INTERNAL EXTERNAL DMZ HA 1 2 3

800F

Esc Enter

CONSOLE

4 USB

Version 2.80 MR6

26 October 2004

01-28006-0024-20041026

No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of Fortinet Inc.

FortiGate-800/800F Installation Guide Version 2.80 MR6 26 October 2004 01-28006-0024-20041026

Trademarks

Products mentioned in this document are trademarks or registered trademarks of their respective holders.

Regulatory Compliance

FCC Class A Part 15 CSA/CUS

CAUTION: RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE. DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTIONS.

For technical support, please visit http://www.fortinet.com.

Send information about errors or omissions in this document or any Fortinet technical documentation to

techdoc@fortinet.com.

Introduction ............................................................................................................ 5

Secure installation, configuration, and management .......................................................... 5

Web-based manager ...................................................................................................... 6

Command line interface .................................................................................................. 6

Setup wizard ................................................................................................................... 7

Document conventions ....................................................................................................... 7

FortiGate documentation .................................................................................................... 8

Related documentation ....................................................................................................... 9

FortiManager documentation .......................................................................................... 9

FortiClient documentation ............................................................................................... 9

FortiMail documentation.................................................................................................. 9

FortiLog documentation ................................................................................................ 10

Comments on Fortinet technical documentation........................................................... 10

Customer service and technical support........................................................................... 11

Getting started ..................................................................................................... 13

Contents

Package contents ............................................................................................................. 14

Mounting ........................................................................................................................... 15

Turning the FortiGate unit power on and off ..................................................................... 16

Connecting to the web-based manager............................................................................ 16

Connecting to the command line interface (CLI)............................................................... 17

Factory default FortiGate configuration settings ............................................................... 19

Factory default NAT/Route mode network configuration .............................................. 19

Factory default Transparent mode network configuration............................................. 20

Factory default firewall configuration ............................................................................ 21

Factory default protection profiles................................................................................. 21

Planning the FortiGate configuration ................................................................................ 23

NAT/Route mode .......................................................................................................... 23

NAT/Route mode with multiple external network connections ...................................... 24

Transparent mode......................................................................................................... 24

Configuration options .................................................................................................... 25

Next steps ......................................................................................................................... 26

NAT/Route mode installation.............................................................................. 27

Preparing to configure the FortiGate unit in NAT/Route mode ......................................... 27

DHCP or PPPoE configuration ..................................................................................... 28

Using the web-based manager ......................................................................................... 29

Configuring basic settings............................................................................................. 29

Using the front control buttons and LCD........................................................................... 30

Using the command line interface..................................................................................... 31

Configuring the FortiGate unit to operate in NAT/Route mode ..................................... 31

FortiGate-800/800F Installation Guide 01-28006-0024-20041026 3

Contents

Using the setup wizard...................................................................................................... 34

Starting the setup wizard .............................................................................................. 35

Connecting the FortiGate unit to the network(s) ............................................................... 36

Configuring the networks .................................................................................................. 38

Next steps ......................................................................................................................... 39

Transparent mode installation............................................................................ 41

Preparing to configure Transparent mode ........................................................................ 41

Using the web-based manager ......................................................................................... 42

Reconnecting to the web-based manager .................................................................... 43

Using the front control buttons and LCD........................................................................... 43

Using the command line interface..................................................................................... 44

Using the setup wizard...................................................................................................... 45

Reconnecting to the web-based manager .................................................................... 46

Connecting the FortiGate unit to your network ................................................................. 46

Next steps ......................................................................................................................... 48

High availability installation................................................................................ 51

Priorities of heartbeat device and monitor priorities...................................................... 51

Configuring FortiGate units for HA operation.................................................................... 51

High availability configuration settings .......................................................................... 51

Configuring FortiGate units for HA using the web-based manager .............................. 53

Configuring FortiGate units for HA using the CLI.......................................................... 54

Connecting the cluster to your networks........................................................................... 55

Installing and configuring the cluster................................................................................. 57

Index ...................................................................................................................... 59

4 01-28006-0024-20041026 Fortinet Inc.

FortiGate-800/800F Installation Guide Version 2.80 MR6

Introduction

FortiGate Antivirus Firewalls improve network security, reduce network misuse and abuse, and help you use communications resources more efficiently without compromising the performance of your network. FortiGate Antivirus Firewalls are ICSA-certified for firewall, IPSec, and antivirus services.

The FortiGate Antivirus Firewall is a dedicated easily managed security device that delivers a full suite of capabilities that include:

• application-level services such as virus protection and content filtering,

• network-level services such as firewall, intrusion detection, VPN, and traffic shaping.

The FortiGate Antivirus Firewall uses Fortinet’s Accelerated Behavior and Content Analysis System (ABACAS™) technology, which leverages breakthroughs in chip design, networking, security, and content analysis. The unique ASIC-based architecture analyzes content and behavior in real-time, enabling key applications to be deployed right at the network edge where they are most effective at protecting your networks.

The FortiGate-800/800F model provides the performance demanded by large enterprises. Features include high throughput, a total of 8 network connections (4 user-defined), 802.1Q VLAN support, virtual domains, stateful failover HA, and support for the RIP and OSPF routing protocols. The flexibility, reliability, and easy management of the FortiGate-800/800F makes it a natural choice for enterprise applications.

800F

FortiGate-800

INTERNAL EXTERNAL DMZ HA 123

Esc Enter

PWR

FortiGate-800F

PWR

INTERNAL EXTERNAL DMZ HA 1 2 3

Esc Enter

4 USB

CONSOLE

4USB

Secure installation, configuration, and management

The FortiGate unit default configuration includes default interface IP addresses and is only a few steps away from protecting your network. There are several ways to configure basic FortiGate settings:

• the web-based manager,

• the front panel front keypad and LCD,

• the command line interface (CLI), or

• the setup wizard.

FortiGate-800/800F Installation Guide 01-28006-0024-20041026 5

Web-based manager Introduction

The CLI or the web-based manager can then be used to complete configuration and to perform maintenance and administration.

Web-based manager

Using HTTP or a secure HTTPS connection from any computer running Internet Explorer, you can configure and manage the FortiGate unit. The web-based manager supports multiple languages. You can configure the FortiGate unit for HTTP and HTTPS administration from any FortiGate interface.

You can use the web-based manager to configure most FortiGate settings. You can also use the web-based manager to monitor the status of the FortiGate unit. Configuration changes made using the web-based manager are effective immediately without resetting the firewall or interrupting service. Once you are satisfied with a configuration, you can download and save it. The saved configuration can be restored at any time.

Figure 1: FortiGate web-based manager and setup wizard

Command line interface

You can access the FortiGate command line interface (CLI) by connecting a management computer serial port to the FortiGate RS-232 serial console connector. You can also use Telnet or a secure SSH connection to connect to the CLI from any network that is connected to the FortiGate unit, including the Internet.

The CLI supports the same configuration and monitoring functionality as the web-based manager. In addition, you can use the CLI for advanced configuration options that are not available from the web-based manager.

This Installation Guide contains information about basic and advanced CLI commands. For a more complete description about connecting to and using the FortiGate CLI, see the FortiGate CLI Reference Guide.

6 01-28006-0024-20041026 Fortinet Inc.

Introduction Setup wizard

Setup wizard

The FortiGate setup wizard provides an easy way to configure the basic initial settings for the FortiGate unit. The wizard walks through the configuration of a new administrator password, FortiGate interfaces, DHCP server settings, internal servers (web, FTP, etc.), and basic antivirus settings.

Document conventions

This guide uses the following conventions to describe command syntax.

• Angle brackets < > to indicate variables.

For example:

execute restore config <filename_str>

You enter:

execute restore config myfile.bak

<xxx_str> indicates an ASCII string that does not contain new-lines or carriage

returns.

<xxx_integer> indicates an integer string that is a decimal (base 10) number.

<xxx_octet> indicates a hexadecimal string that uses the digits 0-9 and letters

A-F.

<xxx_ipv4> indicates a dotted decimal IPv4 address.

<xxx_v4mask> indicates a dotted decimal IPv4 netmask.

<xxx_ipv4mask> indicates a dotted decimal IPv4 address followed by a dotted

decimal IPv4 netmask.

<xxx_ipv6> indicates a dotted decimal IPv6 address.

<xxx_v6mask> indicates a dotted decimal IPv6 netmask.

<xxx_ipv6mask> indicates a dotted decimal IPv6 address followed by a dotted

decimal IPv6 netmask.

• Vertical bar and curly brackets {|} to separate alternative, mutually exclusive required keywords.

For example:

set opmode {nat | transparent}

You can enter set opmode nat or set opmode transparent.

• Square brackets [ ] to indicate that a keyword or variable is optional.

For example:

show system interface [<name_str>]

To show the settings for all interfaces, you can enter show system interface. To show the settings for the internal interface, you can enter show system interface internal.

• A space to separate options that can be entered in any combination and must be separated by spaces.

For example:

FortiGate-800/800F Installation Guide 01-28006-0024-20041026 7

Setup wizard Introduction

set allowaccess {ping https ssh snmp http telnet}

You can enter any of the following:

set allowaccess ping

set allowaccess ping https ssh

set allowaccess https ping ssh

set allowaccess snmp

In most cases to make changes to lists that contain options separated by spaces, you need to retype the whole list including all the options you want to apply and excluding all the options you want to remove.

FortiGate documentation

Information about FortiGate products is available from the following guides:

• FortiGate QuickStart Guide

Provides basic information about connecting and installing a FortiGate unit.

• FortiGate Installation Guide

Describes how to install a FortiGate unit. Includes a hardware reference, default configuration information, installation procedures, connection procedures, and basic configuration procedures. Choose the guide for your product model number.

• FortiGate Administration Guide

Provides basic information about how to configure a FortiGate unit, including how to define FortiGate protection profiles and firewall policies; how to apply intrusion prevention, antivirus protection, web content filtering, and spam filtering; and how to configure a VPN.

• FortiGate online help

Provides a context-sensitive and searchable version of the Administration Guide in HTML format. You can access online help from the web-based manager as you work.

• FortiGate CLI Reference Guide

Describes how to use the FortiGate CLI and contains a reference to all FortiGate CLI commands.

• FortiGate Log Message Reference Guide

Describes the structure of FortiGate log messages and provides information about the log messages that are generated by FortiGate units.

• FortiGate High Availability Guide

Contains in-depth information about the FortiGate high availability feature and the FortiGate clustering protocol.

8 01-28006-0024-20041026 Fortinet Inc.

Introduction FortiManager documentation

Customer service and technical support

For antivirus and attack definition updates, firmware updates, updated product documentation, technical support information, and other resources, please visit the Fortinet technical support web site at http://support.fortinet.com.

You can also register FortiGate Antivirus Firewalls from http://support.fortinet.com and change your registration information at any time.

Fortinet email support is available from the following addresses:

amer_support@fortinet.com For customers in the United States, Canada, Mexico, Latin

apac_support@fortinet.com For customers in Japan, Korea, China, Hong Kong, Singapore,

eu_support@fortinet.com For customers in the United Kingdom, Scandinavia, Mainland

America and South America.

Malaysia, all other Asian countries, and Australia.

Europe, Africa, and the Middle East.

For information on Fortinet telephone support, see http://support.fortinet.com.

When requesting technical support, please provide the following information:

• Your name

• Company name

•Location

• Email address

• Telephone number

• FortiGate unit serial number

• FortiGate model

• FortiGate FortiOS firmware version

• Detailed description of the problem

FortiGate-800/800F Installation Guide 01-28006-0024-20041026 11

Comments on Fortinet technical documentation Introduction

12 01-28006-0024-20041026 Fortinet Inc.

FortiGate-800/800F Installation Guide Version 2.80 MR6

Getting started

This section describes unpacking, setting up, and powering on a FortiGate Antivirus Firewall unit. This section includes:

• Package contents

• Mounting

• Turning the FortiGate unit power on and off

• Connecting to the web-based manager

• Connecting to the command line interface (CLI)

• Factory default FortiGate configuration settings

• Planning the FortiGate configuration

• Next steps

FortiGate-800/800F Installation Guide 01-28006-0024-20041026 13

Package contents

The FortiGate-800 and FortiGate-800F package contains the following items:

• FortiGate-800 or FortiGate-800F Antivirus Firewall

• one orange crossover ethernet cable (Fortinet part number CC300248)

• one grey regular ethernet cable (Fortinet part number CC300249)

• one RJ-45 to DB-9 serial cable

• SFP transceivers (FortiGate-800F only)

• one power cable

• two 19-inch rack mount brackets

• FortiGate-800 or FortiGate-800F QuickStart Guide

• CD containing Fortinet user documentation

Figure 2: FortiGate-800 package contents

Getting started

Front

EXTERNAL DMZ HA 123

LCD Control

Esc Enter

Buttons

INTERNAL

PWR

Internal,External,DMZ

HA Interface

Back

Figure 3: FortiGate-800F package contents

Front

LCD Control

Esc Enter

Buttons

PWR

INTERNAL EXTERNAL DMZ HA

Fiber-optic Internal,External,

DMZ HA Interface

Back

123

1 to 4

Interface

1 to 4

Interface

4 USB

CONSOLE

Serial

Port

Power

Connection

CONSOLE

4 USB

Serial

Port

USB

(future)

Power Switch

USB

(future)

USER MANUAL

Ethernet Cables:

Orange - Crossover

Grey - Straight-through

RJ-45 Serial Cable

RJ-45 to

DB-9 Serial Cable

Power Cable

Rack-Mount Brackets

FortiGate-800

EXTERNAL DMZ HA 123

INTERNAL

4USB

CONSOLE

Esc Enter

PWR

QuickStart Guide

Documentation

Ethernet Cables:

Orange - Crossover

Grey - Straight-through

RJ-45 Serial Cable

x4 SFP Transceivers

RJ-45 to

DB-9 Serial Cable

Power Cable

Power

Connection

Power Switch

USER MANUAL

FortiGate-800

Esc Enter

QuickStart Guide

INTERNALEXTERNAL DMZ HA 123

PWR

4USB

CONSOLE

Documentation

14 01-28006-0024-20041026 Fortinet Inc.

Rack-Mount Brackets

Getting started

Mounting

The FortiGate-800/800F unit can be mounted in a standard 19-inch rack. It requires 1 U of vertical space in the rack.

The FortiGate-800/800F unit can also be installed as a free-standing appliance on any stable surface.

Dimensions

• 16.75 x 12 x 1.75 in. (42.7 x 30.5 x 4.5 cm)

Weight

• 10 lb. (4.5 kg)

Power requirements

• Power dissipation: 300 W (max)

• AC input voltage: 100 to 240 VAC

• AC input current: 6 A

• Frequency: 50 to 60 Hz

• The FortiGate-800/800F unit may overload your supply circuit and impact your overcurrent protection and supply wiring. Use appropriate equipment nameplate ratings to address this concern.

• Make sure that the FortiGate-800/800F unit has reliable grounding. Fortinet recommends direct connections to the branch circuit.

Environmental specifications

• Operating temperature: 41 to 95°F (5 to 35°C)

• Storage temperature: -4 to 176°F (-20 to 80°C)

• Humidity: 10 to 90% non-condensing

• If you install the FortiGate-800/800F unit in a closed or multi-unit rack assembly, the operating ambient temperature of the rack environment may be greater than room ambient. Make sure the operating ambient temperature does not exceed the manufacturer's maximum rated ambient temperature.

Air flow

• For rack installation, make sure that the amount of air flow required for safe operation of the FortiGate unit is not compromised.

• For free-standing installation, make sure that the FortiGate unit has at least 1.5 in. (3.75 cm) of clearance on each side to allow for adequate air flow and cooling.

Mechanical loading

• For rack installation, make sure the mechanical loading of the FortiGate unit is evenly distributed to avoid a hazardous condition.

FortiGate-800/800F Installation Guide 01-28006-0024-20041026 15

Turning the FortiGate unit power on and off

Table 1: FortiGate-800 LED indicators

LED State Description

Power Green The FortiGate unit is powered on.

Off The FortiGate unit is powered off.

Internal External DMZ HA 1 to 4

Table 2: FortiGate-800F LED indicators

LED State Description

Power Green The FortiGate-800F unit is powered on.

Internal External DMZ HA

Amber The correct cable is in use and the connected equipment has

Flashing amber

Green The interface is connected. Internal, External, DMZ and HA

Off No link established.

Off The FortiGate-800F unit is powered off.

Amber The correct cable is in use and the connected equipment has

Flashing Amber

Off No link established.

power.

Network activity at this interface.

connect at up to 1000 Mbps. Interfaces 1, 2, 3 and 4 connect at up to 100 Mbps.

power.

Network activity at this interface.

Getting started

To power off the FortiGate unit

Always shut down the FortiGate operating system properly before turning off the power switch.

1 From the web-based manager, go to System > Maintenance > ShutDown, select

Shut Down and select Apply, or from the CLI, enter:

execute shutdown

2 Turn off the power switch.

3 Disconnect the power cable from the power supply.

Connecting to the web-based manager

Use the following procedure to connect to the web-based manager for the first time. Configuration changes made with the web-based manager are effective immediately without resetting the firewall or interrupting service.

16 01-28006-0024-20041026 Fortinet Inc.

Getting started

To connect to the web-based manager, you need:

• a computer with an ethernet connection,

• Internet Explorer version 6.0 or higher,

• a crossover cable or an ethernet hub and two ethernet cables.

Note: You can use the web-based manager with recent versions of most popular web browsers. The web-based manager is fully supported for Internet Explorer version 6.0 or higher.

To connect to the web-based manager

1 Set the IP address of the computer with an ethernet connection to the static IP

address 192.168.1.2 with a netmask of 255.255.255.0.

2 Start Internet Explorer and browse to the address https://192.168.1.99. (remember to

include the “s” in https://). The FortiGate login is displayed.

Figure 4: FortiGate login

3 Type admin in the Name field and select Login.

Connecting to the command line interface (CLI)

As an alternative to the web-based manager, you can install and configure the FortiGate unit using the CLI. Configuration changes made with the CLI are effective immediately without resetting the firewall or interrupting service.

To connect to the FortiGate CLI, you need:

• a computer with an available communications port,

• the RJ-45 serial cable included in your FortiGate package,

• the RJ-45 to DB-9 convertor included in your FortiGate package (if required),

• terminal emulation software such as HyperTerminal for Windows.

FortiGate-800/800F Installation Guide 01-28006-0024-20041026 17

Getting started

Note: The following procedure describes how to connect to the CLI using Windows HyperTerminal software. You can use any terminal emulation program.

To connect to the CLI

1 Connect the serial cable to the communications port of your computer and to the

FortiGate Console port. Use the RJ-45 to DB-9 convertor if your PC communications port requires a DB-9

connector.

2 Make sure that the FortiGate unit is powered on.

3 Start HyperTerminal, enter a name for the connection, and select OK.

4 Configure HyperTerminal to connect directly to the communications port on your

computer and select OK.

5 Select the following port settings and select OK.

Bits per second 9600

Data bits 8

Parity None

Stop bits 1

Flow control None

6 Press Enter to connect to the FortiGate CLI.

The following prompt is displayed:

FortiGate-800 login:

FortiGate-800F login:

7 Ty pe admin and press Enter twice.

The following prompt is displayed:

Welcome !

Type ? to list available commands. For information about how to use the CLI, see the FortiGate CLI Reference Guide.

18 01-28006-0024-20041026 Fortinet Inc.

+ 42 hidden pages

Fortinet 800F, 800 User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual

Table of Contents

Introduction

Secure installation, configuration, and management

Web-based manager

Command line interface

Setup wizard

Document conventions

FortiGate documentation

Related documentation

FortiManager documentation

FortiClient documentation

FortiMail documentation

FortiLog documentation

Comments on Fortinet technical documentation

Customer service and technical support

Getting started

Package contents

Mounting

Dimensions

Weight

Power requirements

Environmental specifications

Air flow

Mechanical loading

Turning the FortiGate unit power on and off

Connecting to the web-based manager

Connecting to the command line interface (CLI)