Fortinet FortiGate FortiGate-300 Quick Start Manual

Esc Enter

Straight-through Ethernet cable connects to Internet (public switch, router or modem)

Straight-through Ethernet cable connects to LAN or switch on internal network

Crossover Ethernet cable connects to management computer on internal network

Optional null modem cable connects to serial port on management computer

Power cable connects to power outlet

Straight-through Ethernet cable connects to DMZ network, or to another FortiGate-300 for HA

Esc Enter

Connector Type Speed Protocol Description

Internal RJ-45 10/100Base_T Ethernet Connection to the internal network.

External RJ-45 10/100Base_T Ethernet Connection to the Internet.

DMZ/HA RJ-45 10/100Base_T Ethernet

Optional connection to a DMZ network, or other FortiGate-300 units for high availability (HA). For details, see the Documentation CD-ROM.

CONSOLE DB-9 115200 bps

RS-232 serial

Optional connection to the management computer. Provides access to the command line interface (CLI).

FortiGate-300 LED Indicators

LED State Description

Power

Green The FortiGate unit is powered on.

Off The FortiGate unit is powered off.

Internal External DMZ/HA

Amber

The correct cable is in use, and the connected equipment has power.

Flashing amber

Network activity at this interface.

Green The interface is connected at 100 Mbps.

Off No link established.

Connect the FortiGate-300 unit to power outlets and to the internal and external networks.

NAT/Route mode

In NAT/Route mode, the FortiGate-300 is visible to the networks that it is connected to. All of its interfaces are on different subnets. You must configure the internal and external interfaces with IP addresses. Optionally, you can also configure the DMZ interface.

You would typically use NAT/Route mode when the FortiGate-300 is deployed as a gateway between private and public networks. In its default NAT/Route mode configuration, the unit functions as a firewall. Firewall policies control communications through the FortiGate-300 unit. No traffic can pass through the FortiGate-300 unit until you add firewall policies.

In NAT/Route mode, firewall policies can operate in NAT mode or in Route mode. In NAT mode, the FortiGate-300 performs network address translation before IP packets are sent to the destination network. In Route mode, no translation takes place.

Transparent mode

In Transparent mode, the FortiGate-300 is invisible to the network. All of its interfaces are on the same subnet. You only have to configure a management IP address so that you can make configuration changes.

You would typically use the FortiGate-300 in Transparent mode on a private network behind an existing firewall or behind a router. In its default Transparent mode configuration, the unit functions as a firewall. No traffic can pass through the FortiGate-300 unit until you add firewall policies.

You can connect up to three network segments to the FortiGate-300 unit to control traffic between these network segments.

FortiGate-300 Unit

in NAT/Route mode

Route mode policies controlling traffic between internal networks.

Internal network

DMZ network

Internal

192.168.1.99

DMZ

10.10.10.1

192.168.1.1

10.10.10.2

External

204.23.1.5

NAT mode policies controlling traffic between internal and external networks.

Esc Enter

Internet

Internal network

10.10.10.3

FortiGate-300 Unit

in Transparent mode

10.10.10.1

Management IP

External

Internal

10.10.10.2

Transparent mode policies controlling traffic between internal and external networks

204.23.1.5

(firewall, router)

Gateway to public network

Internet

Esc Enter

Before configuring the FortiGate-300, you need to plan how to integrate the unit into your network. Your configuration plan is dependent upon the operating mode that you select: NAT/ Route mode (the default) or Transparent mode.

Web-based manager and Setup Wizard

Using the Setup Wizard you can add basic settings by stepping through the wizard pages and filling in the information required.

The FortiGate web-based manager is an easy to use management tool. Use it to configure the administrator password, interface addresses, the default gateway address, and the DNS server addresses.

Requirements:

• Ethernet connection between the FortiGate-300 and a management computer.

• Internet Explorer version 6.0 or higher on the management computer.

Command Line Interface (CLI)

The CLI is a full-featured management tool.

Use it to configure the administrator password, the interface addresses, the default gateway

address, and the DNS server addresses. To configure advanced settings, see the Documentation CD-ROM.

Requirements:

• The RJ-45-serial connection between the

FortiGate-300 and management computer.

• A terminal emulation application (HyperTerminal for

Windows) on the management computer.

Control Buttons & LCD

The control buttons and LCD are located on the front panel of the FortiGate-300. Use them to configure the internal, external and Port 1 (DMZ) interface addresses, and the default gateway address. To configure the other interface addresses, and the DNS server addresses, use the web-based manager or the CLI.

Requirements:

• Physical access to the FortiGate-300.

Choose among three different tools to configure the FortiGate-300.

QuickStart Guide

FortiGate-300

Check that the package contents are complete.

• Place the unit on a stable surface or mount it in a 19-inch rack. It requires 1.5 inches clearance (3.75 cm) on each side to allow for cooling.

• Make sure the power switch on the back of the unit is turned off before connecting the power and network cables.

• MAIN MENU appears when the unit is up and running.

Checking the package contents

Connecting the FortiGate-300

Planning the configuration

Choosing a configuration tool

Trademarks

Products mentioned in this document are trademarks or registered trademarks of their respective holders.

Regulatory Compliance

FCC Class A Part 15 CSA/CUS 03 November 2004

For technical support please visit http://www.fortinet.com.

Front

Back

Esc Enter

LCD Control

Buttons

DMZ/HA Interface

External Interface

Internal

Interface

Power Light

RS-232 Serial

Connection

Removable

Hard Drive

Power Connection

Power Switch

Power Cable

Rack-Mount Brackets

Null-Modem Cable

(RS-232)

Documentation

Ethernet Cables:

Orange - Crossover

Grey - Straight-through

USER MANUAL

Esc Enter

FortiGate-300

QuickStart Guide

Factory default settings

NAT/Route mode Transparent mode

Internal interface 192.168.1.99 Management IP 10.10.10.1

External interface 192.168.100.99

Administrative account settings

DMZ/HA interface 10.10.10.1 User name admin

Password (none)

Refer to the Documentation CD-ROM for information on how to control traffic, and how to configure HA, antivirus protection, Web content filtering, Spam filtering, intrusion prevention (IPS), and virtual private networking (VPN).

01-28005-0035-20041103

Using the Control Buttons and LCD

• Use the Enter key to access the Main Menu, to select menu items, to move right when entering IP addresses, and to confirm changes.

• Use the arrow keys to move up and down in the Main Menu, and to change IP address numbers.

• Use the Esc key to return to the Main Menu, and to move left when entering IP addresses.

2. Configure the management compute r to be on the same subnet as the internal interface of the FortiGate-300. To do this, change the IP address of the management computer to 192.168.1.2 and the netmask to 255.255.255.0.

3. To access the FortiGate web-based manager, start Internet Explorer and browse to https://192.168.1.99 (remember to include the “s” in https://).

4. Type admin in the Name field and select Login.

Web-based manager and Setup Wizard

NAT/Route mode

To configure the FortiGate-300 using the Setup Wizard, select the Easy Setup Wizard button and follow the prompts.

To change the administrator password

1. Go to System > Admin > Administrators.

2. Select Change Password for the admin administrator and enter a new password.

To configure interfaces

1. Go to System > Network > Interface.

2. Select the edit icon for each interface to configure.

3. Set the addressing mode for the interface. (See the online help for information.)

• For manual addressing, enter the IP address and netmask for the interface.

• For DHCP addressing, select DHCP and any required settings.

• For PPPoE addressing, select PPPoE, and enter the username and password and any other required settings.

To configure the Primary and Secondary DNS server IP addresses

1. Go to System > Network > DNS, enter the Primary and Secondary DNS IP addresses that you recorded above and select Apply.

To configure a Default Gateway

1. Go to Router > Static and select Edit icon for the static route.

2. Set Gateway to the Default Gateway IP address that you recorded above and select OK.

Transparent mode

To switch from NAT/route mode to transparent mode

1. Go to System > Status, select Change beside Operation Mode, and select OK.

2. Change the IP address of the management computer to 10.10.10.2 and use Internet Explorer to browse to https://10.10.10.1.

To configure the FortiGate-300 using the Setup Wizard, select the Easy Setup Wizard button and follow the prompts.

To change the administrator password

1. Go to System > Admin > Administrators.

2. Select Change Password for the admin administrator and enter a new password.

To configure the management interface

1. Go to System > Network > Management.

2. Enter the Management IP address and netmask that you recorded above.

3. Select administrative access options if required and select OK.

To configure the Primary and Secondary DNS server IP addresses

1. Go to System > Netwo rk > DNS, enter the Primary and Secondary DNS IP addresses that you recorded above and select Apply.

To configure a Default Gateway

1. Go to System > Network > Management.

2. Set Default Gateway to the Default Gateway IP address that you recorded above and select OK.

Select the

Easy Setup Wizard

NAT/Route mode

1. Configure the FortiGate-300 internal interface.

config system interface

edit internal

set mode static set ip <intf_ip> <netmask_ip>

end

2. Repeat to configure each interface, for example, to configure the external interface.

config system interface

edit external

...

3. Configure the primary and secondary DNS server IP addresses.

config system dns

set primary <dns-server_ip> set secondary <dns-server_ip>

end

4. Configure the default gateway.

config router static

edit 1

set gateway <gateway_ip>

end

Transparent mode

1. Change from NAT/Route mode to Transparent mode.

config system global

set opmode transparent

end

2. Wait a moment and then log in again at the prompt.

3. Configure the Management IP address.

config system manageip

set ip <mng_ip> <netmask>

end

Configure the DNS server IP address.

config system dns

set primary <dns-server_ip> set secondary <dns-server_ip>

end

4. Configure the default route.

config router static

edit 1

set gateway <gateway_ip>

end

NAT/Route mode

Use the control buttons and LCD to:

• configure the Internal, External, and DMZ interface IP addresses and netmasks.

• configure the External interface Default Gateway.

Transparent mode

Use the control buttons and LCD to:

• change the operating mode from NAT/Route to Transparent.

• configure the Management Interface IP address and netmask.

• configure the Default Gateway.

Note: When you enter an IP address, the LCD display always shows three digits for each part of the IP address. For example, the IP address 192.168.100.1 appears on the LCD display as 192.168.100.001.

Using the Command Line Interface

1. Use the serial cable to connect the FortiGate Console port to the management computer serial port.

2. Start a terminal emulation program (HyperTerminal) on the management computer. Use these settings: Baud Rate (bps) 9600, Data bits 8, Parity None, Stop bits 1, and Flow Control None.

3. At the Login: prompt, type admin and press Enter twice (no password required).

1. Connect the FortiGate-300 internal interface to a management comp uter Ethernet interface. Use a cross-over Ethernet cable to connect the devices directly. Use straight-through Ethernet cables to connect the devices through a hub or switch.

Note: If you change the internal interface IP address (NAT/Route mode) or management IP address (Transparent mode), you must use this address to reconnect to the web-based manager and Setup Wizard.

You might also have to change the IP address of the management computer to be on the same subnet as the new IP address.

Configuring the FortiGate-300

NAT/Route mode

The internal interface IP address and netmask must be valid for the internal network.

Transparent mode

The management IP address and netmask must be valid for the network from which you will manage the FortiGate-300.

General settings

A default gateway is required for the FortiGate unit to route connections to the Internet.

Internal Interface:

IP:

____.____.____.____

Netmask:

____.____.____.____

External Interface:

IP:

____.____.____.____

Netmask:

____.____.____.____

DMZ/HA Interface

IP:

____.____.____.____

Netmask:

____.____.____.____

Management IP:

IP:

____.____.____.____

Netmask:

____.____.____.____

Administrator password:

Network Settings:

Default Gateway:

____.____.____.____

Primary DNS Server:

____.____.____.____

Secondary DNS Server:

____.____.____.____

Use these tables to record your FortiGate-300 configuration.

Collecting information

Congratulations! You have finished configuring the basic settings. Your network is now protected from

Internet-based threats. To explore the full range of configuration options, see the online help or the Documentation CD-ROM.

Completing the configuration

• To restart the unit, go to System > Maintenance > ShutDown and select Reboot.

• To reset the unit, go to System > Maintenance > Shutdown and select Reset to factory default.

Restarting the FortiGate-300

Should you mistakenly change a network setting and cannot connect to the unit, reboot the unit and try again or to set the unit back to factory defaults and start over again.

CLI:

execute reboot

CLI:

execute factoryreset

Fortinet FortiGate FortiGate-300 Quick Start Manual

Specifications and Main Features

Frequently Asked Questions

User Manual