Fortinet FortiGate FortiGate-800 Quick Start Manual

Esc Enter

CONSOLE

INTERNAL EXTERNAL DMZ HA

123

4 USB

PWR

Connector Type Speed Protocol Description

Internal RJ-45 10/100/1000 Base-T Ethernet Connection to the internal network.

External RJ-45 10/100/1000 Base-T Ethernet Connection to the Internet.

DMZ RJ-45 10/100/1000 Base-T Ethernet Optional connection to a DMZ network.

HA RJ-45 10/100/1000 Base-T Ethernet

Optional connection to other FortiGate-800 units for high availability (HA).

1 to 4 RJ-45 10/100 Base-T Ethernet Optional connections to other networks.

CONSOLE RJ-45 9,600 bps RS-232

Optional connection to the management computer. Provides access to the command line interface (CLI).

FortiGate-800 LED indicators

Factory defaults

LED State Description

Power

Green The FortiGate-800 unit is powered on.

Off The FortiGate-800 unit is powered off.

Internal External DMZ HA 1 to 4

Amber

The correct cable is in use and the connected equipment has power.

Flashing Amber

Network activity at this interface.

Green

The interface is connected.

• Internal, External, DMZ and HA connect at up to 1000 Mbps.

• 1, 2, 3 and 4 connect at up to 100 Mbps.

Off No link established.

Interface

Internal External DMZ

192.168.1.99

192.168.100.99

10.10.10.1

0.0.0.0

NAT/Route mode IP addressesIPTransparent mode IP address

admin (none)

Administrator account settings

User Name Password

MANAGEMENT IP 10.10.10.1

Interface IP

1 to 4

0.0.0.0

Connect the FortiGate-800 unit to a power outlet and to the internal and external networks.

NAT/Route mode

In NAT/Route mode, each FortiGate-800 unit is visible to the networks that it is connected to. All of its interfaces are on different subnets. Each interface that is connected to a network must be configured with an IP address that is valid for that network.

You would typically use NAT/Route mode when the FortiGate-800 unit is deployed as a gateway between private and public networks. In its default NAT/Route mode configuration, the unit functions as a firewall. Firewall policies control communications through the FortiGate-800 unit. No traffic can pass through the FortiGate-800 unit until you add firewall policies.

In NAT/Route mode, firewall policies can operate in NAT mode or in Route mode. In NAT mode, the FortiGate-800 unit performs network address translation before IP packets are sent to the destination network. In Route mode, no translation takes place.

Transparent mode

In Transparent mode, the FortiGate-800 unit is invisible to the network. All of its interfaces are on the same subnet. You only have to configure a management IP address so that you can make configuration changes.

You would typically use the FortiGate-800 unit in Transparent mode on a private network behind an existing firewall or behind a router. In its default Transparent mode configuration, the unit functions as a firewall. No traffic can pass through the FortiGate-800 unit until you add firewall policies.

You can connect up to 8 network segments to the FortiGate-800 unit to control traffic between these network segments.

FortiGate-800 Unit

in NAT/Route mode

Route mode policies controlling traffic between internal networks.

Internal network

DMZ network

Internal

192.168.1.99

DMZ

10.10.10.1

192.168.1.3

10.10.10.2

External

204.23.1.5

NAT mode policies controlling

traffic between internal and

external networks.

Internet

Esc Enter

CONSOLE

INTERNAL

EXTERNAL DMZ HA 1 23

4 USB

PWR

Internal network

10.10.10.3

FortiGate-800 Unit

in Transparent mode

10.10.10.1

Management IP

External

Internal

10.10.10.2

Transparent mode policies controlling traffic between

internal and external networks

204.23.1.5

(firewall, router)

Gateway to

public network

Internet

Esc Enter

CONSOLE

INTERNAL

EXTERNAL DMZ HA 123

4 USB

PWR

Before beginning to configure the FortiGate-800, you need to plan how to integrate the unit into your network. Your configuration plan is dependent upon the operating mode that you select: NAT/Route mode (the default) or Transparent mode.

Web-based manager and Setup Wizard

The FortiGate web-based manager is an easy to use management tool.

Use it to configure the administrator password, the internal, external and DMZ interface addresses, the default gateway address, and the DNS server addresses.

Requirements:

• The Ethernet connection between the FortiGate-800

and management computer.

• Internet Explorer version 6.0 or higher on the

management computer.

Command Line Interface (CLI)

The CLI is a full-featured management tool.

Use it to configure the administrator password, the interface addresses, the default gateway address, and the DNS

server addresses. To configure advanced settings, see the Documentation CD-ROM.

Requirements:

• The RJ-45-serial connection between the

FortiGate-800 and management computer.

• A terminal emulation application (HyperTerminal for

Windows) on the management computer.

Control Buttons & LCD

The control buttons and LCD are located on the front panel of the FortiGate-800. Use them to configure the internal, external and DMZ interface addresses, and the default gateway address. To configure the other interface addresses, and the DNS server addresses, use the web-based manager or the CLI.

Requirements:

• Physical access to the FortiGate-800.

Choose among three different tools to configure the FortiGate-800.

QuickStart Guide

FortiGate-800

Check that the package contents are complete.

Esc Enter

CONSOLE

INTERNAL EXTERNAL DMZ HA 123

4 USB

PWR

Front

1 to 4

Interface

LCD Control

Buttons

Internal,External,DMZ

HA Interface

Power

Connection

Serial

Port

Power Switch

USB

(future)

Back

Power Cable

Rack-Mount Brackets

RJ-45 Serial Cable

Ethernet Cables:

Orange - Crossover

Grey - Straight-through

Documentation

USER MANUAL

FortiGate-800

QuickStart Guide

Esc Enter

CONSOLE

INTERNALEXTERNAL DMZ HA 123

4USB

PWR

RJ-45 to DB-9 Converto

• Place the unit on a stable surface or mount it in a 19-inch rack. It requires

1.5 inches (3.75 cm) clearance on each side to allow for cooling.

• Make sure the power switch on the back of the unit is turned off before connecting the power and network cables.

• MAIN MENU appears when the unit is up and running.

Esc Enter

CONSOLE

INTERNAL EXTERNAL DMZ HA 123

4USB

PWR

Power cable connects to power outlet

Straight-through Ethernet cable connects to Internet (public switch, router or modem)

Straight-through Ethernet cable connects to DMZ network

Straight-through Ethernet cable connects to another FortiGate-800 for HA

Straight-through Ethernet cables connect to other networks

Optional RJ-45 serial cable connects to management computer

USB (future use)

Straight-through Ethernet cable connects to LAN or switch on internal network

Crossover Ethernet cable connects to management computer on internal network

Checking the package contents

Connecting the FortiGate-800

Planning the configuration

Choosing a configuration tool

Trademarks

Products mentioned in this document are trademarks or registered trademarks of their respective holders.

Regulatory Compliance

FCC Class A Part 15 CSA/CUS 12 January 2005

For technical support please visit http://www.fortinet.com.

Refer to the Documentation CD-ROM for information on how to control traffic, and how to configure HA, antivirus protection, Web content filtering, Spam filtering, intrusion prevention (IPS), and virtual private networking (VPN).

01-28005-0038-20050112

Using the Control Buttons and LCD

• Use the Enter key to access the Main Menu, to select menu items, to move right when entering IP addresses, and to confirm changes.

• Use the arrow keys to move up and down in the Main Menu, and to change IP address numbers.

• Use the Esc key to return to the Main Menu, and to move left when entering IP addresses.

NAT/Route mode

The internal interface IP address and netmask must be valid for the internal network.

Transparent mode

The management IP address and netmask must be valid for the network from which you will manage the FortiGate-800.

General settings

A default gateway is required for the FortiGate unit to route connections to the Internet.

Internal Interface:

IP:

____.____.____.____

Netmask:

____.____.____.____

External Interface:

IP:

____.____.____.____

Netmask:

____.____.____.____

_________ Interface:

IP:

____.____.____.____

Netmask:

____.____.____.____

_________ Interface:

IP:

____.____.____.____

Netmask:

____.____.____.____

_________ Interface:

IP:

____.____.____.____

Netmask:

____.____.____.____

Management IP:

IP:

____.____.____.____

Netmask:

____.____.____.____

Administrator password:

Network Settings:

Default Gateway:

____.____.____.____

Primary DNS Server:

____.____.____.____

Secondary DNS Server:

____.____.____.____

2. Configure the management computer to be on the same subnet as the internal interface of the FortiGate-800. To do this, change the IP address of the management computer to 192.168.1.2 and the netmask to 255.255.255.0.

3. To access the FortiGate web-based manager, start Internet Explorer and browse to https://192.168.1.99 (remember to include the “s” in https://).

4. Type admin in the Name field and select Login.

Web-based manager and Setup Wizard

Use these tables to record your FortiGate-800 configuration. You can record NAT/Route or Transparent mode settings and general settings that apply to both modes. For NAT/Route mode you can record settings for the Internal and External interface and three other interfaces.

NAT/Route mode

To configure the FortiGate-800 using the Setup Wizard, select the Easy Setup Wizard button and follow the prompts.

To change the administrator password

1. Go to System > Admin > Administrators.

2. Select Change Password for the admin administrator and enter a new password.

To configure interfaces

1. Go to System > Network > Interface.

2. Select the edit icon for each interface to configure.

3. Set the addressing mode for the interface. (see the online help for information.)

•For manual addressing, enter the IP address and netmask for the interface.

•For DHCP addressing, select DHCP and any required settings.

•For PPPoE addressing, select PPPoE, and enter the username and password and any other required settings.

To configure the Primary and Secondary DNS server IP addresses

1. Go to System > Network > DNS, enter the Primary and Secondary DNS IP addresses that you recorded above and select Apply.

To configure a Default Gateway

1. Go to Router > Static and select Edit icon for the static route.

2. Set Gateway to the Default Gateway IP address that you recorded above and select OK.

Transparent mode

To switch from NAT/route mode to transparent mode

1. Go to System > Status, select Change beside Operation Mode, and select OK.

2. Change the IP address of the management computer to 10.10.10.2 and use Internet Explorer to browse to https://10.10.10.1.

To configure the FortiGate-800 using the Setup Wizard, select the Easy Setup Wizard button and follow the prompts.

To change the administrator password

1. Go to System > Admin > Administrators.

2. Select Change Password for the admin administrator and enter a new password.

To configure the management interface

1. Go to System > Network > Management.

2. Enter the Management IP address and netmask that you recorded above.

3. Select administrative access options if required and select OK.

To configure the Primary and Secondary DNS server IP addresses

1. Go to System > Network > DNS, enter the Primary and Secondary DNS IP addresses that you recorded above and select Apply.

To configure a Default Gateway

1. Go to System > Network > Management.

2. Set Default Gateway to the Default Gateway IP address that you recorded above and select OK.

Select the

Easy Setup Wizard

NAT/Route mode

1. Configure the FortiGate-800 internal interface.

config system interface

edit internal

set mode static set ip <intf_ip> <netmask_ip>

end

2. Repeat to configure each interface, for example, to configure the external interface.

config system interface

edit external

...

3. Configure the primary and secondary DNS server IP addresses.

config system dns

set primary <dns-server_ip> set secondary <dns-server_ip>

end

4. Configure the default gateway.

config router static

edit 1

set gateway <gateway_ip>

end

Transparent mode

1. Change from NAT/Route mode to Transparent mode.

config system global

set opmode transparent

end

2. Wait a moment and then log in again at the prompt.

3. Configure the Management IP address.

config system manageip

set ip <mng_ip> <netmask>

end

Configure the DNS server IP address.

config system dns

set primary <dns-server_ip> set secondary <dns-server_ip>

end

4. Configure the default route.

config router static

edit 1

set gateway <gateway_ip>

end

NAT/Route mode

Use the control buttons and LCD to:

• configure the Internal, External, and DMZ interface IP addresses and netmasks.

• configure the External interface Default Gateway.

Transparent mode

Use the control buttons and LCD to:

• change the operating mode from NAT/Route to Transparent.

• configure the Management Interface IP address and netmask.

• configure the Default Gateway.

Note: When you enter an IP address, the LCD display always shows three digits for each part of the IP address. For example, the IP address 192.168.100.1 appears on the LCD display as 192.168.100.001.

Using the Command Line Interface

1. Use the RJ-45 serial cable and converter to connect the FortiGate Console port to the management computer serial port.

2. Start a terminal emulation program (HyperTerminal) on the management computer. Use these settings: Baud Rate (bps) 9600, Data bits 8, Parity None, Stop bits 1, and Flow Control None.

3. At the Login: prompt, type admin and press Enter twice (no password required).

1. Connect the FortiGate-800 internal interface to a management computer Ethernet interface. Use a cross-over Ethernet cable to connect the devices directly. Use straight-through Ethernet cables to connect the devices through a hub or switch.

Note: If you change the internal interface IP address (NAT/Route mode) or management IP address (Transparent mode), you must use this address to reconnect to the web-based manager and Setup Wizard.

You might also have to change the IP address of the management computer to be on the same subnet as the new IP address.

Collecting information

Configuring the FortiGate-800

Congratulations! You have finished configuring the basic settings. Your network is now protected from

Internet-based threats. To explore the full range of configuration options, see the online help or the Documentation CD-ROM.

Completing the configuration

• To restart the unit, go to System > Maintenance > ShutDown and select Reboot.

• To reset the unit, go to System > Maintenance > Shutdown and select Reset to factory default.

Restarting the FortiGate-800

Should you mistakenly change a network setting and cannot connect to the unit, reboot the unit and try again or to set the unit back to factory defaults and start over again.

CLI:

execute reboot

CLI:

execute factoryreset

Fortinet FortiGate FortiGate-800 Quick Start Manual

Specifications and Main Features

Frequently Asked Questions

User Manual