Fortinet FortiGate FortiGate-100A Quick Start Manual

© Copyright 2007 Fortinet Incorporated. All rights reserved.
Products mentioned in this document are trademarks or registered trade­marks of their respective holders.
Regulatory Compliance
FCC Class A Part 15 CSA/CUS
17 January 2007

INTERNAL

DMZ 1

4321

LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100

WAN 1 WAN 2

PWR STATUS

A

DMZ 2

Internal Interface

(4-port switch conn ectors)

WAN

1,2

DMZ

1,2

Internal Interface

(4-port switch)

Ethernet Cables:

Orange - Crossover

Grey - St raight-thro ugh

Power Ca ble Power Supply

Back

Front

1234

Console

USB

WAN 2 WAN 1

DMZ 2 DMZ 1

DC+12V

Internal

Power

Connecti on

RS-232 Serial

Connection

USB

DMZ2

DMZ1

WAN2

WAN1

Document ation

FortiGate-100A

Copyright 2006 Fortinet Incorporated . All right s reserved.

Trademarks
Products mentioned in this document are tradema rks.

Qui c kS t a rt Gu i d e

INTERNAL

EXTERNAL

DMZ

POWER

STATUS

Status
LED

Power

LED

RJ-45 to

DB-9 Seri al Cable

Console

WAN 2

WAN 1

DMZ 2 DMZ 1Internal

Optiona l RS-232 se rial cable connects to serial por t on manage ment comput er

Straigh t-through E thernet
cables connect to Internet
(public switch, ro uter or mod em)

Power c able connec ts to power supply

Straigh t-through

Etherne t cables co nnect

to comp uters on in ternal netw ork

Optiona l connectio n to
1 or 2 DMZ network s

1234

USB

DC+12V

Checking the Package Contents

Connecting

Planning the Configuration

Connector Type Speed Protocol Description

Internal RJ-45 10/100 Base-T Ethernet A 4-port switch connection for up to four network

devices or the internal network.

WAN1 and
WAN2

RJ-45 10/100 Base-T Ethernet Connection to the Internet.

DMZ1 and
DMZ2

RJ-45 10/100 Base-T Ethernet Optional connection to one or two DMZ networks, or

other FortiGate-100A units for high availability (HA).
For details, see the Documentation CD-ROM.

Console RJ-45 9600 Bps RS-232 Optional connection to the management computer.

Provides access to the command line interface
(CLI).

USB USB USB Optional connection for the FortiUSB key, modem or

backup operation

Place the unit on a stable surface. It requires 1.5 inches (3.75 cm) clearance above and
on each side to allow for cooling.
Plug in power cable to the unit before connecting power.

The Status light ashes while the unit is starting up and turns off when the system is up

and running.

•

•

•

Connect the FortiGate unit to a power outlet and to the internal and external networks.

Before beginning to congure the FortiGate unit, you need to plan how to integrate the unit into your network. Your conguration plan depends on the operating mode you select: NAT/Route

mode (the default) or Transparent mode.

NAT/Route mode

In NAT/Route mode, each FortiGate unit is visible to the network that it is connected to. All

of its interfaces are on

different subnets. Each
interface that is connected
to a network must be
congured with an IP ad­dress that is valid for that
network.

You would typically use

NAT/Route mode when
the FortiGate unit is
deployed as a gateway
between private and public
networks. In its default

NAT/Route mode congu-

ration, the unit functions as a rewall. Firewall policies control communications through the

FortiGate unit. No

trafc can pass through the FortiGate unit until you add rewall policies. In NAT/Route mode,
rewall policies can operate in NAT mode or in Route mode. In NAT mode, the FortiGate unit

performs network address translation before IP packets are sent to the destination network.
In Route mode, no translation takes place.

Transparent mode

In Transparent mode, the FortiGate unit is invisible to the network. All of its interfaces are on

the same subnet. You only have to congure a management IP address so that you can make

conguration changes.
You would typically use the

FortiGate unit in Transparent
mode on a private network

behind an existing rewall or

behind a router. In its default

Transparent mode conguration,
the unit functions as a rewall.
No trafc can pass through the

FortiGate unit until you add

rewall policies.

You can connect up to four network segments to the FortiGate unit to control trafc between

these network segments.

Router

Internet

Inter nal
netwo rk

10.10.10.3

Internal

WAN1

Gateway to public network

204.23.1.5 10.10.10.2

Transparent mode policies
controlling traffic between
internal and external networks

Refer to the Documentation CD-ROM for information on how to control trafc, and how to congure HA, antivirus protection, FortiGuard, Web content ltering, Spam ltering,

intrusion prevention (IPS), and virtual private networking (VPN).

FortiGate-100A

01-30004-0066-20070117

LED State Description

Power

Green The FortiGate unit is on.

Off The FortiGate unit is off.

Status

Flashing Green The FortiGate unit is starting up.

Green The FortiGate unit is running normally.

Off The FortiGate unit is powered off.

Link
Internal, 1, 2, 3, 4,
WAN1 and WAN2,
DMZ1 and DMZ2

Green The correct cable is in use and the connected

equipment has power.

Flashing Green Network activity at this interface.

Off No link established.

100
Internal, 1, 2, 3, 4,
WAN1 and WAN2,
DMZ1 and DMZ2

Green The interface is connected at 100Mbps.

Router

Internet

Inter nal
netwo rk

DMZ

netwo rk

192.168.1.3

Internal network

192.168.1.99

DMZ network

10.10.10.1

10.10.10.2

NAT mode policies
controlling traffic between
internal and external networks

Route mode policies
controlling traffic between
internal networks

WAN1

204.23.1.5

DMZ

Internal

Choosing a Configuration Tool

Web-based manager

The FortiGate web-based manager is an easy to use management tool. Use it to congure

the administrator password, the interface and default gateway addresses, and the DNS
server addresses.

Requirements:

An Ethernet connection between the FortiGate unit and management computer.
Internet Explorer 6.0 or higher on the management computer.

•

•

Command Line Interface (CLI)

The CLI is a full-featured management tool. Use it to congure the administrator password,

the interface addresses, the default gateway address, and the DNS server addresses. To

congure advanced settings, see the Documentation CD-ROM.

Requirements:

The DB-9 serial connection between the FortiGate unit and management computer.
A terminal emulation application (HyperTerminal for Windows) on the management
computer.

•

•

INTERNAL

DMZ 1

4321

LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100 LINK 100

WAN 1 WAN 2

PWR STATUS

A

DMZ 2

Completing the Configuration

7

Congratulations!

You have nished conguring the basic settings. Your network is now protected from Internet­based threats. To explore the full range of conguration options, see the online help or the

Documentation CD-ROM.

Visit these links for more information and documentation for your Fortinet product.

Technical Documentation - http://docs.forticare.com
Fortinet Knowledge Center - http://kc.forticare.com
Fortinet Technical Support - http://support.fortinet.com

•

•

•

NAT/Route Mode

Internal Interface IP: ____.____.____.____

Netmask: ____.____.____.____

WAN1 IP: ____.____.____.____

Netmask: ____.____.____.____

WAN2 IP: ____.____.____.____

Netmask: ____.____.____.____

DMZ1 IP: ____.____.____.____

Netmask: ____.____.____.____

DMZ2 IP: ____.____.____.____

Netmask: ____.____.____.____

The internal interface IP address and netmask must be valid for the internal network.

Transparent mode

Management IP IP: ____.____.____.____

Netmask: ____.____.____.____

The management IP address and netmask must be valid for the network you will be
managing the FortiGate unit from.

General settings

Administrator password:

Network Settings: Default Gateway:

____.____.____.____

Primary DNS Server: ____.____.____.____

Secondary DNS Server: ____.____.____.____

A default gateway is required for the FortiGate unit to route connections to the Internet.

Factory default settings

NAT/Route mode Transparent mode

Internal interface 192.168.1.99 Management IP 0.0.0.0

WAN1 192.168.100.99 Administrative account settings

WAN2 192.168.101.99 User name admin

DMZ1 10.10.10.1 Password (none)

DMZ2 0.0.0.0.

Configuring the FortiGate Unit

Web-based Manager

Connect the FortiGate internal interface to a management computer Ethernet interface.
Use a cross-over Ethernet cable to connect the devices directly. Use straight-through
Ethernet cables to connect the devices through a hub or switch.

Congure the management computer to be on the same subnet as the internal

interface of the FortiGate unit. To do this, change the IP address of the management
computer to 192.168.1.2 and the netmask to 255.255.255.0.
To access the FortiGate web-based manager, start Internet Explorer and browse to

https://192.168.1.99 (remember to include the “s” in https://).
Type admin in the Name eld and select Login.

NAT/Route mode

To change the administrator password

Go to System > Admin > Administrators.
Select Change Password for the admin administrator and enter a new password.

To congure interfaces

Go to System > Network > Interface.

Select the edit icon for each interface to congure.

Set the addressing mode for the interface. (See the online help for information.)

For manual addressing, enter the IP address and netmask for the interface.
For DHCP addressing, select DHCP and any required settings.
For PPPoE addressing, select PPPoE, and enter the username and password
and any other required settings.

To congure the Primary and Secondary DNS server IP addresses

Go to System > Network > Options, enter the Primary and Secondary DNS IP
addresses that you recorded above and select Apply.

To congure a Default Gateway

Go to Router > Static and select Edit icon for the static route.
Set Gateway to the Default Gateway IP address you recorded above and select OK.

Transparent mode

To switch from NAT/route mode to transparent mode

Go to System > Status, select Transparent.
Set the Management IP/Netmask to 192.168.1.99/24.
Set a default gateway and select apply.

To change the administrator password

Go to System > Admin > Administrators.
Select Change Password for the admin administrator and enter a new password.

To change the management interface

Go to System > Cong > Operation Mode.
Enter the Management IP address and netmask that you recorded above and select
Apply.

To congure the Primary and Secondary DNS server IP addresses

Go to System > Network > Options, enter the Primary and Secondary DNS IP
addresses that you recorded in step 5 and select Apply.

1.

2.

3.

4.

1.

2.

1.

2.

3.

•

•

•

1.

1.

2.

1.

2.

3.

1.

2.

1.

2.

1.

Command Line Interface

Use the RJ-45 to DB9 to connect the FortiGate Console port to the management com­puter serial port.
Start a terminal emulation program (HyperTerminal) on the management computer.

Use these settings: Baud Rate (bps) 9600, Data bits 8, Parity None, Stop bits 1, and

Flow Control None.

At the Login: prompt, type admin and press Enter twice (no password required).

NAT/Rout mode

Congure the FortiGate internal interface.

config system interface
edit internal
set ip <intf_ip>/<netmask>
end

Congure the FortiGate external interface.

config system interface
edit wan1
set ip <intf_ip>/<netmask>

Congure the primary and secondary DNS server IP addresses.

config system dns
set primary <dns-server_ip>
set secondary <dns-server_ip>
end

Congure the default gateway.

config router static
edit 1
set gateway <gateway_ip>
end

Transparent Mode

Change from NAT/Route mode to Transparent mode and congure the Management IP

address.

config system settings
set opmode transparent
set manageip <mng_ip>/<netmask>
set gateway <gateway_ip>
end

Congure the DNS server IP address.

config system dns
set primary <dns-server_ip>
set secondary <dns-server_ip>
end

1.

2.

3.

1.

2.

3.

4.

1.

2.

Collecting Information