FortiGate-60 LED Indicators

FortiGate-60

LEDStateDescription

PowerGreenThe FortiGate unit is powered on.

OffThe FortiGate unit is powered off.

GreenThe FortiGate unit is starting up.

OffThe FortiGate unit is running normally.

Link(InternalDMZ
WAN1
WAN2)

Green

The correct cable is in use and the connected
equipment has power.

Flashing Green

Network activity at this interface.

OffNo link established.

100(InternalDMZ
WAN1
WAN2)

Green

The interface is connected at 100 Mbps.

Status

INTERNAL
PWR

1234

DMZ

WAN1

WAN2

LINK 100

LINK 100

LINK 100

LINK 100LINK 100

LINK 100

LINK 100STATUS

QuickStart Guide© Copyright 2004 Fortinet Incorporated. All rights reserved.
Trademarks
Products mentioned in this document are trademarks or registered trademarks of their respective holders.
Regulatory Compliance
FCC Class A Part 15 CSA/CUS
02 November 2004

For technical support please visit http://www.fortinet.com.

01-28005-0032-20041102

1

Checking thethe package
package contents
contents Check that the package contents are complete.
CheckingFront

Connector Type

Speed

Internal

10/100Base-T Ethernet

4-port switch connection to up to four devices or the internal network.

WAN1 and 2 RJ-45

10/100Base_T Ethernet

Redundant connections to the Internet.

DMZRJ-45

10/100Base-T Ethernet

Optional connection to a DMZ network or to other FortiGate -60 units forhigh availability (HA).

CONSOLE

DB-99600 bps

Optional connection to the management computer.
Provides access to the command line interface (CLI).

RJ-45

USB

USB—Protocol Description

RS-232
serial
USB

1234

DMZ

WAN1

WAN2

LINK 100

LINK 100

LINK 100

LINK 100

LINK 100

LINK 100

LINK 100STATUS

Null-Modem Cable(RS-232)

Power Status
LED LEDDMZ WAN 1,2Interface InterfaceInternalInterfaceBack
Power Cable Power Supply
4•••

1

INTERNAL

USB

WAN2

WAN1

USER MANUALInternalDMZ

PWR

STATUS

1234DMZ

WAN1

WAN2

LINK 100

LINK 100

LINK 100

LINK 100

LINK 100

LINK 100

LINK 100

QuickStart Guide
Copyright 2003 Fortinet Incorporated. All rights reserved.
Trademarks
Products mentioned in this document are trademarks.

DMZ

WAN2

PowerConnection

USB

Documentation

WAN1

Internal Interface,switch connectors
1,2,3,4Connect the FortiGate-60 unit to a power outlet and to the internal and external networks.
Power cable connects to power supplyOptional null modem cable connects to serial port on management computer

Place the unit on a stable surface. It requires 1.5 inches(3.75 cm) clearance above and on each side to allow for cooling.
Make sure the power switch on the back of the unit is turned off before connecting thepower and network cables.
The Status light flashes while the unit is starting up and turns off when the system isup and running.

432

ConsoleUSB

WAN2

WAN1

InternalDMZ

Optional connection to a serial modem(serial to USB adapter required)
Straight-through Ethernet cables connect
to computers on internal network

Straight-through Ethernet cable connects
to Internet (public switch, router or modem)

Planning the configuration

1DC+12V

Optional redundant connection to Internet

32

FortiGate-60

ConsoleOptional connection to a modem for standalone or backup operation.

Connecting the FortiGate-60

3DC+12V

RS-232 SerialConnection

2Ethernet Cables:
Orange - Crossover
Grey - Straight-throughINTERNAL
PWR

Optional connection to DMZ network

Before configuring the FortiGate-60, you need to plan how to integrate the unit into your network.
You can select NAT/Route mode (the default) or Transparent mode. In NAT/Route mode you canalso use the default settings to quickly configure the unit on your network.

Quick configuration using the default settings
You can quickly set up your FortiGate unit for a home or small office using the webbased manager and the default settings in NAT/Route mode.
All you need to do is set your network computers to use DHCP, access the web-based
manager, and configure the required settings for the WAN1 interface. You can also
configure DNS and a default route if needed. The FortiGate unit automatically assigns
IP addresses to up to 100 computers in the internal network.
1. Connect the FortiGate unit to the network.
2. Set the all the network computers to use DHCP to automatically obtain an IPaddress.
The FortiGate internal interface acts as a DHCP server for the internal network andassigns IP addresses to all computers in the range 192.168.1.110 –192.168.1.210.
3. From the management computer browse to https://192.168.1.99.
The FortiGate web-based manager appears.
4. Go to System > Network > Interface and select Edit for the WAN1 interface.
5. Select one of the following Addressing modes• Manual: enter a static IP address and netmask, select OK, and go to step 6• DHCP: to get an IP address from the ISP select DHCP and go to step 9• PPPoE: to get an IP address from the ISP select PPPoE and go to step 9
6. Go to System > Network > DNS.

7. Select one of the following DNS settings• Obtain DNS server address automatically: select to get the DNS addresses
from the ISP, select Apply• Use the following DNS server addresses: select and enter the DNS server
addresses given to you by the ISP, select Apply
8. Go to Router > Static, select Create New, enter the default gateway address andselect OK.
Network configuration is complete. Proceed to part 7 of this Quick Start Guide.
9. Select Retrieve default gateway from server and Override internal DNS options if
your ISP supports them, select OK, and proceed to part 7 of this Quick Start Guide.
Go to step 6 if you are not selecting these options.
FortiGate-60 Unit
Internal network
Internet

INTERNAL
PWR

12

34

DMZ

LINK 100

LINK 100

LINK 100

LINK 100

LINK 100STATUS

WAN1 interface

WAN1

WAN2

LINK 100

LINK 100

Internal interface
192.168.1.99

Configure Manual IP, DHCP, or
PPPoE addressing

DHCP server and DNS server
for the internal network

Obtain IP address andDNS server IP address
automatically

NAT/Route mode

Transparent mode

In NAT/Route mode, the FortiGate-60 is visible to the networks that it is connected to.
All of its interfaces are on different subnets. You must configure the internal and WAN1
interfaces with IP addresses. Optionally, you can also configure the WAN2 and DMZinterfaces.
You would typically use NAT/Route mode when the FortiGate-60 is deployed as agateway between private and public networks. In its default NAT/Route mode
configuration, the unit functions as a firewall. Firewall policies control communications
through the FortiGate-60 unit.

In Transparent mode, the FortiGate-60 is invisible to the network. All of its interfaces
are on the same subnet. You only have to configure a management IP address so thatyou can make configuration changes.
You would typically use the FortiGate-60 in Transparent mode on a private network
behind an existing firewall or behind a router. In its default Transparent mode
configuration, the unit functions as a firewall. By default, the unit has a single firewall
policy that allows users on the internal network segment to connect to the WAN1
network segment. No other traffic is possible until you have configured more policies.

Internal network
192.168.1.3

FortiGate-60 Unit
in NAT/Route mode
Internet

Internal
192.168.1.99

204.23.1.5

WAN1
204.23.1.5

FortiGate-60 Unit
in Transparent mode

Gateway topublic network
10.10.10.2

INTERNAL

Route mode policies
controlling traffic between
internal networks.

INTERNALPWR

STATUS

123

4

DMZ

WAN1

WAN2

LINK 100

LINK 100

LINK 100

LINK 100

LINK 100

LINK 100

LINK 100

NAT mode policies controlling
traffic between internal andexternal networks.

DMZ
10.10.10.1

PWR

WAN1(firewall, router)

STATUS

1234

DMZWAN1WAN2LINK 100

LINK 100

LINK 100

LINK 100

LINK 100

LINK 100

LINK 100

Internal

DMZ network

10.10.10.2

In NAT/Route mode, firewall policies can operate in NAT mode or in Route mode. In
NAT mode, the FortiGate-60 performs network address translation before IP packets
are sent to the destination network. In Route mode, no translation takes place. Bydefault, the unit has a single NAT mode policy that allows users on the internal network
to securely access and download content from the Internet. No other traffic is possible
until you have configured more policies.

InternetTransparent mode policies
controlling traffic between
internal and external networks

10.10.10.1
Management IPInternal network
10.10.10.3

You can connect up to four network segments to the FortiGate-60 unit to control traffic
between these network segments.

Refer to the Documentation CD-ROM for information on how to control traffic, and how to configure HA, antivirus protection, Web content filtering, Spam filtering, intrusion
prevention (IPS), and virtual private networking (VPN).

4Choosing a configuration tool

Choose among two different tools to configure the FortiGate-60.

Web-based manager and Setup Wizard

Command Line Interface (CLI)

Using the Setup Wizard you can add basic settings by stepping through the wizard
pages and filling in the information required.
The FortiGate web-based manager is an easy to use management tool. Use it toconfigure the administrator password, interface addresses, the default gateway
address, and the DNS server addresses.
Requirements: An Ethernet connection between the FortiGate-60 and a management
computer running Internet Explorer version 6.0 or higher.

The CLI is a full-featured management tool.
Use it to configure the administrator password, the interface addresses, the default
gateway address, and the DNS server addresses. To configure advanced settings, see
the Documentation CD-ROM.
Requirements: An RJ-45-serial connection between the FortiGate-60 andmanagement computer and a terminal emulation application (HyperTerminal forWindows) on the management computer.

5Collecting information

Use these tables to record your FortiGate-60 configuration settings.

NAT/Route mode
Internal Interface:

General settings

IP:

WAN1 Interface:IP:
Netmask:

WAN2 Interface

IP:
Netmask:

DMZ

Administrator password:____.____.____.________.____.____.________.____.____.________.____.____.________.____.____.________.____.____.________.____.____.________.____.____.____

Netmask:IP:
Netmask:

Network Settings: Default Gateway:
Primary DNS Server:
Secondary DNS Server:

A default gateway is required for the FortiGate unit to route connections to the Internet.

Factory default settings
NAT/Route mode

The internal interface IP address and netmask must be valid for the internal network.

Transparent mode
Management IP:

IP:
Netmask:____.____.____.________.____.____.____The management IP address and netmask must be valid for the network from which
you will manage the FortiGate-60.

6____.____.____.________.____.____.________.____.____.____

Transparent mode

Internal interface

192.168.1.99

Management IP

10.10.10.1

WAN1 interface

192.168.100.99

Administrative account settings

WAN2 interface

192.168.101.99

User nameadmin

DMZ interface

10.10.10.1

Password(none)

DHCP server on Internalinterface

192.168.1.110 –192.168.1.210

Configuring the FortiGate-60

Web-based manager
and Setup Wizard
NAT/Route mode

1. Connect the FortiGate-60 internal interface to a management computer ethernet interface.
You can connect the management computer directly to the FortiGate-60 internal interface
4-port switch.
2. Configure the management computer to be on the same subnet as the internal interface of the FortiGate-60. To do this,change the IP address of the management computer to 192.168.1.2 and the netmask to 255.255.255.0.
3. To access the FortiGate web-based manager, start Internet Explorer and browse to https://192.168.1.99 (remember toinclude the “s” in https://).
4. Type admin in the Name field and select Login.

Transparent mode

To configure the FortiGate-60 using the Setup Wizard, select theEasy Setup Wizard button and follow the prompts.
Select theEasy Setup Wizard
To change the administrator password
1. Go to System > Admin > Administrators.
2. Select Change Password for the admin administrator and enter a new password.
To configure interfaces
1. Go to System > Network > Interface.
2. Select the edit icon for each interface to configure.
3. Select one of the following Addressing modes (see the online help for information):• Manual: enter a static IP address and netmask, select OK• DHCP: select DHCP and any required settings• PPPoE: select PPPoE and enter a username and password and any otherrequired settings
To configure the Primary and Secondary DNS server IP addresses
1. Go to System > Network > DNS, enter the Primary and Secondary DNS IPaddresses that you recorded above and select Apply.
To configure a Default Gateway
1. Go to Router > Static and select Edit icon for the static route.
2. Set Gateway to the Default Gateway IP address recorded above and select OK.

To switch from NAT/route mode to transparent mode
1. Go to System > Status, select Change beside Operation Mode, and select OK.
2. Change the IP address of the management computer to 10.10.10.2 and use
Internet Explorer to browse to https://10.10.10.1.
To configure the FortiGate-60 using the Setup Wizard, select the Easy Setup Wizardbutton and follow the prompts.
To change the administrator password
1. Go to System > Admin > Administrators.
2. Select Change Password for the admin administrator and enter a new password.
To configure the management interface
1. Go to System > Network > Management.
2. Enter the Management IP address and netmask that you recorded above.
3. Select administrative access options if required and select OK.
To configure the Primary and Secondary DNS server IP addresses
1. Go to System > Network > DNS, enter the Primary and Secondary DNS IPaddresses that you recorded above and select Apply.
To configure a Default Gateway
1. Go to System > Network > Management.
2. Set Default Gateway to the Default Gateway IP address that you recorded aboveand select OK.

Note: If you change the internal interface IP address (NAT/Route mode) or management IP address (Transparent mode), you must use this address to reconnect to the web-based manager and Setup Wizard.
You might also have to change the IP address of the management computer to be on the same subnet as the new IP address.

Using theCommand Line Interface
NAT/Route mode

1. Use the serial cable to connect the FortiGate Console port to the management computer serial port.
2. Start a terminal emulation program (HyperTerminal) on the management computer. Use these settings:
Baud Rate (bps) 9600, Data bits 8, Parity None, Stop bits 1, and Flow Control None.
3. At the Login: prompt, type admin and press Enter twice (no password required).

1. Configure the FortiGate-60 internal interface.
config system interface
edit internal
set mode static
set ip <intf_ip> <netmask_ip>
end
2. Repeat to configure each interface, for example, to configure the WAN1 interface.
config system interface
edit wan1...
3. Configure the primary and secondary DNS server IP addresses.
config system dns
set primary <dns-server_ip>
set secondary <dns-server_ip>
end
4. Configure the default gateway.
config router static
edit 1
set gateway <gateway_ip>
end7

Completing the configuration

Transparent mode
1. Change from NAT/Route mode to Transparent mode.
config system global
set opmode transparentend
2. Wait a moment and then log in again at the prompt.
3. Configure the Management IP address.
config system manageip
set ip <mng_ip> <netmask>
end
Configure the DNS server IP address.
config system dns
set primary <dns-server_ip>
set secondary <dns-server_ip>
end
4. Configure the default route.
config router static
edit 1
set gateway <gateway_ip>
end

Congratulations!
You have finished configuring the basic settings. Your network is now protected fromInternet-based threats. To explore the full range of configuration options, see the online help
or the Documentation CD-ROM.

Restarting the FortiGate-60•Should you mistakenly change a network setting and cannot connect to theunit, reboot the unit and try again or to set the unit back to factory defaults andstart over again.

•To restart the unit, go to System > Maintenance >ShutDown and select Reboot.
To reset the unit, go to System > Maintenance >Shutdown and select Reset to factory default.

CLI: execute reboot
CLI: execute factoryreset