Fortinet FortiGate FortiGate-300 Manuals

www.fortinet.com FortiGate™ Version 3.0 MR4 ADMINISTRATION GUIDE

www.fortinet.com FortiGate-200, FortiGate-300, FortiGate-400, FortiGate-500, and FortiGate-1000 FortiOS 3.0 MR4 I N S T A L L G U I D E

FortiGate 300 Administration Guide Esc Enter FortiGate-300 Administration Guide Version 2.80 MR6 5 November 2004 01-28006-0005-20041105

FortiGate 300 Installation Guide Esc Enter Version 2.80 MR4 30 August 2004 01-28004-0021-20040830

© Copyright 2006 Fortinet Incorporated. All rights reserved. Products mentioned in this document are trademarks or registered trade- marks of their respective holders. Regulatory Compliance FCC Class A Part 15 CSA/CUS 5 July 2006 Checking the Package Contents Connecting Planning the Configuration Connector Type Speed Protocol Description Internal RJ-45 10/100 Base-T Ethernet Connection to the internal network. External RJ-45 10/100 Base-T Ethernet Connection to the Internet. DMZ/HA RJ-45 10/100 Base-T Ethernet Optional connection to a DMZ network, or other FortiGate-300 units for high availability (HA). For details, see the Documentation CD-ROM. Console DB-9 9600 Bps RS-232 Optional connection to the management computer. Provides access to the command line interface (CLI). Place the unit on a stable surface. It requires 1.5 inches (3.75 cm) clearance above and on each side to allow for cooling. Make sure the power switch on the back of the unit is turned off before connecting the power and network cables. The following is displayed on the LCD when the unit is up and running: Menu [ Fortigat -> ] NAT, Standalone • • • Connect the FortiGate unit to a power outlet and to the internal and external networks. Before beginning to configure the FortiGate unit, you need to plan how to integrate the unit into your network. Your configuration plan depends on the operating mode you select: NAT/Route mode (the default) or Transparent mode. NAT/Route mode In NAT/Route mode, each FortiGate unit is visible to the network that it is connected to. All of its interfaces are on different subnets. Each interface that is connected to a network must be configured with an IP address that is valid for that network. You would typically use NAT/Route mode when the FortiGate unit is deployed as a gateway between private and public networks. In its default NAT/Route mode configuration, the unit functions as a firewall. Firewall policies control communications through the FortiGate unit. No traffic can pass through the FortiGate unit until you add firewall policies. In NAT/Route mode, firewall policies can operate in NAT mode or in Route mode. In NAT mode, the FortiGate unit performs network address translation before IP packets are sent to the destination network. In Route mode, no translation takes place. Transparent mode In Transparent mode, the FortiGate unit is invisible to the network. All of its interfaces are on the same subnet. You only have to configure a management IP address so that you can make configuration changes. You would typically use the FortiGate unit in Transparent mode on a private network behind an existing firewall or behind a router. In its default Transparent mode configura- tion, the unit functions as a firewall. No traffic can pass through the FortiGate unit until you add firewall policies. You can connect up to four network segments to the FortiGate unit to control traffic between these network segments. Internet Router External Transparent mode policies controlling traffic between internal and external networks 10.10.10.3 Internal network Internal Gateway to public network 204.23.1.5 10.10.10.2 Management IP 10.10.10.1 Refer to the Documentation CD-ROM for information on how to control traffic, and how to configure HA, antivirus protection, FortiGuard, Web content filtering, Spam filtering, intrusion prevention (IPS), and virtual private networking (VPN). FortiGate-300 01-30002-0035-20060705 LED State Description Power Green The FortiGate unit is on. Off The FortiGate unit is off. Internal External DMZ/HA Amber The correct cable is in use and the connected equipment has power. Flashing Amber Network activity at this interface. Green The interface is connected at 100Mbps. Off No link established. Internet Router External 204.23.2.5 Internal 192.168.1.99 Internal network 192.168.1.1 DMZ 10.10.10.1 DMZ network 10.10.10.3 Route mode policies controlling traffic between internal networks NAT mode policies controlling traffic between internal and external networks Esc Enter Front Back Esc Enter LCD Control Buttons DMZ/HA Interface External Interface Internal Interface Power Light RS-232 Serial Connection Removable Hard Drive Power Connection Power Switch Power Cable Rack-Mount Brackets Null-Modem Cable (RS-232) Ethernet Cables: Orange - Crossover Grey - Straight-through Documentation FortiGate-300 Copyright 2006 Fortinet Incorporated. All rights reserved. Trademarks Products mentioned in this document are trademarks. Q u i c k S t a r t G u i d e Esc Enter Esc Enter Straight-through Ethernet cable connects to Internet (public switch, router or modem) Straight-through Ethernet cable connects to LAN or switch on internal network Crossover Ethernet cable connects to management computer on internal network or Optional null modem cable connects to serial port on management computer Power cable connects to power outlet Straight-through Ethernet cable connects to DMZ network, or to another FortiGate-300 for HA

Esc Enter Straight-through Ethernet cable connects to Internet (public switch, router or modem) Straight-through Ethernet cable connects to LAN or switch on internal network Crossover Ethernet cable connects to management computer on internal network or Optional null modem cable connects to serial port on management computer Power cable connects to power outlet Straight-through Ethernet cable connects to DMZ network, or to another FortiGate-300 for HA Esc Enter Connector Type Speed Protocol Description Internal RJ-45 10/100Base_T Ethernet Connection to the internal network. External RJ-45 10/100Base_T Ethernet Connection to the Internet. DMZ/HA RJ-45 10/100Base_T Ethernet Optional connection to a DMZ network, or other FortiGate-300 units for high availability (HA). For details, see the Documentation CD-ROM. CONSOLE DB-9 115200 bps RS-232 serial Optional connection to the management computer. Provides access to the command line interface (CLI). FortiGate-300 LED Indicators LED State Description Power Green The FortiGate unit is powered on. Off The FortiGate unit is powered off. Internal External DMZ/HA Amber The correct cable is in use, and the connected equipment has power. Flashing amber Network activity at this interface. Green The interface is connected at 100 Mbps. Off No link established. Connect the FortiGate-300 unit to power outlets and to the internal and external networks. NAT/Route mode In NAT/Route mode, the FortiGate-300 is visible to the networks that it is connected to. All of its interfaces are on different subnets. You must configure the internal and external interfaces with IP addresses. Optionally, you can also configure the DMZ interface. You would typically use NAT/Route mode when the FortiGate-300 is deployed as a gateway between private and public networks. In its default NAT/Route mode configuration, the unit functions as a firewall. Firewall policies control communications through the FortiGate-300 unit. No traffic can pass through the FortiGate-300 unit until you add firewall policies. In NAT/Route mode, firewall policies can operate in NAT mode or in Route mode. In NAT mode, the FortiGate-300 performs network address translation before IP packets are sent to the destination network. In Route mode, no translation takes place. Transparent mode In Transparent mode, the FortiGate-300 is invisible to the network. All of its interfaces are on the same subnet. You only have to configure a management IP address so that you can make configuration changes. You would typically use the FortiGate-300 in Transparent mode on a private network behind an existing firewall or behind a router. In its default Transparent mode configuration, the unit functions as a firewall. No traffic can pass through the FortiGate-300 unit until you add firewall policies. You can connect up to three network segments to the FortiGate-300 unit to control traffic between these network segments. FortiGate-300 Unit in NAT/Route mode Route mode policies controlling traffic between internal networks. Internal network DMZ network Internal 192.168.1.99 DMZ 10.10.10.1 192.168.1.1 10.10.10.2 External 204.23.1.5 NAT mode policies controlling traffic between internal and external networks. Esc Enter Internet Internal network 10.10.10.3 FortiGate-300 Unit in Transparent mode 10.10.10.1 Management IP External Internal 10.10.10.2 Transparent mode policies controlling traffic between internal and external networks 204.23.1.5 (firewall, router) Gateway to public network Internet Esc Enter Before configuring the FortiGate-300, you need to plan how to integrate the unit into your network. Your configuration plan is dependent upon the operating mode that you select: NAT/ Route mode (the default) or Transparent mode. Web-based manager and Setup Wizard Using the Setup Wizard you can add basic settings by stepping through the wizard pages and filling in the information required. The FortiGate web-based manager is an easy to use management tool. Use it to configure the administrator password, interface addresses, the default gateway address, and the DNS server addresses. Requirements: • Ethernet connection between the FortiGate-300 and a management computer. • Internet Explorer version 6.0 or higher on the management computer. Command Line Interface (CLI) The CLI is a full-featured management tool. Use it to configure the administrator password, the interface addresses, the default gateway address, and the DNS server addresses. To configure advanced settings, see the Documentation CD-ROM. Requirements: • The RJ-45-serial connection between the FortiGate-300 and management computer. • A terminal emulation application (HyperTerminal for Windows) on the management computer. Control Buttons & LCD The control buttons and LCD are located on the front panel of the FortiGate-300. Use them to configure the internal, external and Port 1 (DMZ) interface addresses, and the default gateway address. To configure the other interface addresses, and the DNS server addresses, use the web-based manager or the CLI. Requirements: • Physical access to the FortiGate-300. Choose among three different tools to configure the FortiGate-300. QuickStart Guide FortiGate-300 Check that the package contents are complete. • Place the unit on a stable surface or mount it in a 19-inch rack. It requires 1.5 inches clearance (3.75 cm) on each side to allow for cooling. • Make sure the power switch on the back of the unit is turned off before connecting the power and network cables. • MAIN MENU appears when the unit is up and running. Checking the package contents 1 Connecting the FortiGate-300 2 Planning the configuration 3 Choosing a configuration tool 4 © Copyright 2004 Fortinet Incorporated. All rights reserved. Trademarks Products mentioned in this document are trademarks or registered trademarks of their respective holders. Regulatory Compliance FCC Class A Part 15 CSA/CUS 03 November 2004 For technical support please visit http://www.fortinet.com. Front Back Esc Enter LCD Control Buttons DMZ/HA Interface External Interface Internal Interface Power Light RS-232 Serial Connection Removable Hard Drive Power Connection Power Switch Power Cable Rack-Mount Brackets Null-Modem Cable (RS-232) Documentation Ethernet Cables: Orange - Crossover Grey - Straight-through USER MANUAL Esc Enter FortiGate-300 QuickStart Guide Copyright 2003 Fortinet Incorporated. All rights reserved. Trademarks Products mentioned in this document are trademarks. Factory default settings NAT/Route mode Transparent mode Internal interface 192.168.1.99 Management IP 10.10.10.1 External interface 192.168.100.99 Administrative account settings DMZ/HA interface 10.10.10.1 User name admin Password (none) Refer to the Documentation CD-ROM for information on how to control traffic, and how to configure HA, antivirus protection, Web content filtering, Spam filtering, intrusion prevention (IPS), and virtual private networking (VPN). 01-28005-0035-20041103