Installation. Fortinet FORTIGATE

Installation

This section discusses how to install your FortiGate and use it in your network, after completion of the initial setup outlined in the FortiGate model’s Quick Start Guide. The section also provides troubleshooting tips.

The following topics are included in this section: l l l l l

Setup Wizard

Installing a FortiGate in NAT/Route mode

NAT/Route Mode vs. Transparent Mode

Using a Virtual Wire Pair

Troubleshooting your FortiGate Installation

Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

19

Setup Wizard

The Setup Wizard helps to quickly configure your FortiGate to allow Internet access and remote access. The wizard can be launched from the GUI by selecting the button, located in the top right corner (some entry-level models do not have this button). You can also get to the Setup Wizard through FortiExplorer which can be downloaded for either Windows or Mac OS at www.fortinet.com

. FortiExplorer for iOS will be available through the App Store sometime in April 2017. See the What's New section for details.

More information on connecting to the GUI with FortiExplorer is found in the Using the GUI section.

Using the Setup Wizard

The Setup Wizard is intended to be used for initial setup. If it is used on a previously configured FortiGate, it replaces parts of the configuration, including existing firewall policies.

1. Connect to the FortiGate using FortiExplorer. View FortiExplorer in full-screen mode because some options may not be visible otherwise.

2. Select your FortiGate, then select Setup Wizard.

3. Login using an admin account (the default admin account has the username admin and no password).

4. Select Change Password to set a new password for the admin account. Select Next.

5. Select the appropriate time zone. Select Next.

6. Fill in the appropriate information about your Internet WAN Connection. Select Next.

7. Enter an IP Address and Netmask for your LAN. If necessary, enable DHCP and select a Start and End

Address. Select Next.

8. Select the schedule for when Internet access should be allowed. Select Next.

9. Select the appropriate options for your Internet Access Policy, including NAT options and Unified Threat

Management. Select Next.

10. If necessary, configure options to allow Remote VPN Access using either an SSL VPN or an IPsec VPN. Select

Next.

11. A summary screen will appear. If the configuration shown is correct, select Configure.

12. (Optional) If you wish to activate a FortiCloud account, select Next and enter your information (for more information about FortiCloud, see the FortiCloud FAQ ). Otherwise, select Done.

Results

Your configuration has now been set up on the FortiGate allowing users on the LAN to have Internet access.

20 Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

Quick installation using DHCP

Most of the FortiGate desktop models have a default configuration that includes a DHCP server on the lan (or

internal) interface and a security policy that securely allows all sessions from the Internal network to reach the

Internet. Because of this, you can connect your desktop FortiGate to the Internet in two simple steps.

In order to use this installation method, your ISP must provide connectivity with DHCP and accept DHCP requests without authentication. You must also be using IPv4 to connect your FortiGate to the Internet.

1. Connect the FortiGate's wan interface to your ISP-supplied equipment, and then connect the internal network to the FortiGate’s default lan interface. Turn on the ISP’s equipment, the FortiGate, and the PCs on the internal network.

2. (Windows Vista/7/8/10 users) Go to Network and Sharing Center and select Local Area Connections. Select

Properties. Select Internet Protocol Version 4 (TCP/IPv4), then select Properties. Select Obtain an IP

address automatically and Obtain DNS server address automatically.

(Mac OS X users) Go to

System Preferences > Network and select Ethernet. Set Configure IPv4 to Using

DHCP.

Results

From any PC on the internal network, open a web browser and browse to any website. You can successfully connect to the Internet.

Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

21

Installing a FortiGate in NAT/Route mode

There are two main ways to install a FortiGate using network address translation (NAT)/Route mode:

Standard

Installation in NAT/Route Mode , where Internet access is provided by a single ISP, and

Redundant Internet

Installation , where two ISPs are used.

Standard Installation in NAT/Route Mode

In this configuration, a FortiGate is installed as a gateway or router between a private network and the Internet.

By using NAT, the FortiGate is able to hide the IP addresses of the private network.

22

Installing a FortiGate in NAT/Route Mode

1. Connect the FortiGate’s Internet-facing interface (typically WAN or WAN1) to your ISP-supplied equipment.

2. Connect a PC to the FortiGate using an internal port (typically port 1).

3. Power on the ISP’s equipment, the FortiGate, and the PC on the internal network.

4. From the PC on the internal network, connect to the FortiGate’s GUI using either FortiExplorer or an Internet browser (for information about connecting to the GUI, please see your model's QuickStart Guide). Login using an admin account (the default admin account has the username admin and no password).

5. Go to Network > Interfaces and edit the Internet-facing interface. Set Roleto WAN and set the Estimated

Bandwidth/Netmask using Kbps.

Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

Installing a FortiGate in NAT/Route mode

If your FortiGate is directly connected to your ISP, set Addressing Mode to

Manual and set the IP/Netmask to the private IP address you wish to use for the FortiGate.

If you have ISP equipment between your FortiGate and the Internet (for example, a router), then the wan1 IP will also use a private IP assigned by the ISP equipment. If this equipment uses DHCP, set

Addressing Mode to

DHCP to get an IP assigned to the interface.

If the ISP equipment does not use DHCP, your ISP can provide you with the correct private IP to use for the interface.

6. Edit the

lan interface (called internal on some FortiGate models). Make sure the interface's Role is set to LAN.

If you need your FortiGate to provide IP addresses to devices that connect to it, enable

DHCP Server.

7. Go to Network > Static Routes and select Create New to add a default route. Set Destination to Subnet, which allows you to input a numeric IP address or subnet. Set

Destination IP/Mask to 0.0.0.0/0.0.0.0, Device to the Internet-facing interface, and

Gateway to the gateway (or default route) provided by your ISP or to the next hop router, depending on your network requirements.

A default route always has a Destination IP/Mask of 0.0.0.0/0.0.0.0. Normally, you would have only one default route. If the static route list already contains a default route, you can either edit it or delete it and add a new one.

8. (Optional) The FortiGate’s DNS Settings are set to use FortiGuard DNS servers by default, which is sufficient for most networks. However, if you need to change the DNS servers, go to

Network > DNS, select Specify, and add

Primary and Secondary DNS servers.

Some FortiGate models include an IPv4 security policy allowing access from

LAN/Internal to WAN/WAN1 in the default configuration. This policy can be found at Policy & Objects > IPv4 Policy.

If you have one of these models, users are now able to access the Internet.

9. Go to

Policy & Objects > IPv4 Policy and select Create New to add a security policy that allows users on the private network to access the Internet. Give the policy a Name that indicates that the policy will be for traffic to the

Internet.

Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

23

Installing a FortiGate in NAT/Route mode

If your network uses IPv6 addresses, go to Policy & Objects > IPv6 Policy and select Create New to add a security policy that allows users on the private network to access the Internet. If the IPv6 menu option is not available, go to

System > Feature

Select, turn on IPv6, and select Apply. For more information on IPv6 networks, see the IPv6 Chapter of the Handbook .

10. In the policy, set the

Incoming Interface to lan and the Outgoing Interface to the Internet-facing interface.

You will also need to set Source, Destination Address, Schedule, and Service according to your network requirements. You can set these fields to the default all/ANY settings for now but should create the appropriate objects later after the policies have been verified. Make sure the Action is set to ACCEPT. Enable NAT and make sure Use Outgoing Interface Address is selected.

It is recommended to avoid using any security profiles, such as AntiVirus or Web Filter, until after you have successfully installed the FortiGate. After the installation is verified, you can apply any required security profiles.

For more information about using security profiles, see the Security Profiles chapter of the Handbook .

Results

Users on the internal network are now able to access the Internet. They should also be able to connect to the

Internet using any other protocol or connection method that you defined in the security policy.

Redundant Internet Installation

In this configuration, a WAN link interface is created providing the FortiGate with redundant Internet connections from two Internet service providers (ISPs). The WAN link interface combines these two connections, allowing the

FortiGate to treat them as a single interface.

24

Installing a FortiGate with Redundant Internet

Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

Installing a FortiGate in NAT/Route mode

If you have previously configured your FortiGate using the standard installation, you will have to delete all routes and policies referring to an interface that will be used to provide redundant Internet. This includes the default Internet access policy that is included on many FortiGate models.

1. Connect your ISP devices to your FortiGate’s Internet-facing interfaces (typically WAN1 and WAN2).

2. Go to

Network > SD-WAN to create a WAN link interface, which is used to group multiple Internet connections together so that the FortiGate can treat them as a single interface.

3. Set the Interface State to Enable.

4. Under SD-WAN, select Create New. Add WAN1 and enter the Gateway IP provided by your primary ISP. Do the same for WAN2, but use the Gateway IP provided by your secondary ISP.

5. Select an appropriate method for the

Load Balancing Algorithm from the following options: l l l l l

Volume - A volume ratio is set for each active member of the SD-WAN link.

Sessions - A sessions ratio is set for each active member of the SD-WAN link.

Spillover - A traffic cap is defined for active members; when it is exceeded, the traffic will automatically activate the standby link.

Source-Destination IP - The next hop is based on both the traffic’s source and destination IP address.

Source IP based - The next hop is based on the traffic’s source IP address.

4. Add your Internet-facing interfaces to the WAN link interface and configure load balancing as required for each interface.

5. Go to

Network > Static Routes and create a new default route. Set Device to the SD-WAN link.

6. Go to Policy & Objects > IPv4 Policy and select Create New to add a security policy that allows users on the private network to access the Internet.

If your network uses IPv6 addresses, go to Policy & Objects > IPv6 Policy and select

Create New to add a security policy that allows users on the private network to access the Internet. If the IPv6 menu option is not available, go to

System > Feature

Select, turn on IPv6, and select Apply. For more information on IPv6 networks, see the IPv6 Handbook.

4. In the policy, set the Incoming Interface to the internal interface and the Outgoing Interface to the SD-WAN link interface. You will also need to set Source Address, Destination Address, Schedule, and Service according to your network requirements. You can set these fields to the default all/ANY settings for now but should create the appropriate objects later after the policies have been verified.

5. Make sure the Action is set to ACCEPT. Enable NAT and make sure Use Destination Interface Address is selected. Select OK.

Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

25

Installing a FortiGate in NAT/Route mode

It is recommended to avoid using any security profiles, such as AntiVirus or Web Filter, until after you have successfully installed the FortiGate. After the installation is verified, you can apply any required security profiles.

For more information about using security profiles, see the Security Profiles handbook.

Results

Users on the internal network are now able to browse the Internet. They should also be able to connect to the

Internet using any other protocol or connection method defined in the security policy.

The amount of traffic an individual member of the SD-WAN link interface will use depends on the load balancing algorithm selected. You can view this usage by going to

FortiView > All Sessions and viewing the Destination

Interface column. If this column is not shown, right-click on the title row and select Destination Interface from the dropdown menu. Scroll to the bottom of the menu and select

Apply.

26 Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

NAT/Route Mode vs. Transparent Mode

A FortiGate can operate in one of two modes: NAT/Route or Transparent.

The most common of the two operating modes is NAT/Route mode, where a FortiGate is installed as a gateway or router between two networks. In most cases, it is used between a private network and the Internet. This allows the FortiGate to hide the IP addresses of the private network using network address translation (NAT).

NAT/Route mode is also used when two or more Internet service providers (ISPs) provide the FortiGate with redundant Internet connections.

A FortiGate in Transparent mode is installed between the internal network and the router. In this mode, the

FortiGate does not make any changes to IP addresses and only applies security scanning to traffic. When a

FortiGate is added to a network in Transparent mode, no network changes are required, except to provide the

FortiGate with a management IP address. Transparent mode is used primarily when there is a need to increase network protection but changing the configuration of the network itself is impractical.

For more information about Transparent Mode, see the Transparent Mode handbook.

Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

27

Using a Virtual Wire Pair

A virtual wire pair consists of two interfaces that have no IP addressing and are treated similar to a transparent mode VDOM. All traffic received by one interface in the virtual wire pair can only be forwarded out the other interface, provided that a virtual wire pair firewall policy allows this traffic. Traffic from other interfaces cannot be routed to the interfaces in a virtual wire pair.

Virtual wire pairs are useful for unusual topologies where MAC addresses do not behave normally: for example, port pairing can be used in a Direct Server Return (DSR) topology where the response MAC address pair may not match the request’s MAC address pair.

In FortiOS 5.4, virtual wire pairing replaced the port pairing feature available in earlier firmware versions. Unlike port pairing, virtual wire pairing can be used for FortiGates in both NAT/Route and Transparent modes.

In the example configuration below, a virtual wire pair (consisting of port3 and port4) makes it easier to protect a web server that is behind a FortiGate operating as an Internal Segmentation Firewall (ISFW). Users on the internal network will access the web server through the ISFW over the virtual wire pair.

28

Adding a virtual wire pair and virtual wire pair policy

Interfaces used in a virtual wire pair cannot be used to access the ISFW FortiGate.

Before creating a virtual wire pair, make sure you have a different port configured to allow admin access using your preferred protocol.

1. Go to Network > Interfaces and select Create New > Virtual Wire Pair.

2. Select the interfaces to add to the virtual wire pair. These interfaces cannot be part of a switch, such as the default

lan/internal interface.

3. (Optional) If desired, enable Wildcard VLAN.

4. Select OK.

5. Go to Policy & Objects > IPv4 Virtual Wire Pair Policy, select the virtual wire pair, and select Create New.

6. Select the direction that traffic is allowed to flow.

7. Configure the other firewall options as desired.

8. Select OK .

9. If necessary, create a second virtual wire pair policy to allow traffic to flow in the opposite direction.

Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

Using a Virtual Wire Pair

If you have a USB-wan interface, it will not be included in the interface list when building a wired-pair.

Results

Traffic can now flow through the FortiGate using the virtual wire pair.

For more information on this feature in FortiOS 5.6.0 , see the Firewall chapter.

Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

29

Troubleshooting your FortiGate Installation

If your FortiGate does not function as desired after installation, try the following troubleshooting tips:

1.

Use FortiExplorer if you can’t connect to the FortiGate over Ethernet.

If you can’t connect to the FortiGate GUI or CLI, you may be able to connect using FortiExplorer. Refer to the

QuickStart Guide or see the section on the FortiExplorer for more details.

2.

Check for equipment issues.

Verify that all network equipment is powered on and operating as expected. Refer to the QuickStart Guide for information about connecting your FortiGate to the network. You will also find detailed information about the

FortiGate LED indicators.

3.

Check the physical network connections.

Check the cables used for all physical connections to ensure that they are fully connected and do not appear damaged, and make sure that each cable connects to the correct device and the correct Ethernet port on that device.

4.

Verify that you can connect to the internal IP address of the FortiGate.

Connect to the GUI from the FortiGate’s internal interface by browsing to its IP address. From the PC, try to ping the internal interface IP address; for example, ping 192.168.1.99.

If you cannot connect to the internal interface, verify the IP configuration of the PC. If you can ping the interface but can't connect to the GUI, check the settings for administrative access on that interface.

5.

Check the FortiGate interface configurations.

Check the configuration of the FortiGate interface connected to the internal network by going to

Network

> Interfaces and make sure Addressing Mode is set to the correct mode.

6.

Verify the security policy configuration.

Go to Policy & Objects > IPv4 Policy and verify that the internal interface to Internet-facing interface security policy has been added and is located near the top of the policy list. Check the Active Sessions column to ensure that traffic has been processed (if this column does not appear, right-click on the title row, select

Active

Sessions).

If you are using NAT/Route mode, check the configuration of the policy to make sure that

NAT is enabled and that

Use Outgoing Interface Address is selected.

7.

Verify that you can connect to the Internet-facing interface’s IP address.

Ping the IP address of the FortiGate’s Internet-facing interface. If you cannot connect to the interface, the

FortiGate is not allowing sessions from the internal interface to Internet-facing interface.

8.

Verify the static routing configuration.

Go to Network > Static Routes and verify that the default route is correct. Go to Monitor > Routing Monitor and verify that the default route appears in the list as a static route. Along with the default route, you should see two routes shown as Connected, one for each connected FortiGate interface.

9.

Verify that you can connect to the gateway provided by your ISP.

Ping the default gateway IP address from a PC on the internal network. If you cannot reach the gateway, contact your ISP to verify that you are using the correct gateway.

10.

Verify that you can communicate from the FortiGate to the Internet.

Access the FortiGate CLI and use the command execute ping8.8.8.8. You can also use the execute traceroute 8.8.8.8

command to troubleshoot connectivity to the Internet.

11.

Verify the DNS configurations of the FortiGate and the PCs.

Check for DNS errors by pinging or using traceroute to connect to a domain name; for example: ping www.fortinet.com

30 Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

Troubleshooting your FortiGate Installation

If the name cannot be resolved, the FortiGate or PC cannot connect to a DNS server and you should confirm that the DNS server IP addresses are present and correct.

12.

Confirm that the FortiGate can connect to the FortiGuard network.

Once registered, the FortiGate obtains AntiVirus and Application Control and other updates from the FortiGuard network. Once the FortiGate is on your network, you should confirm that it can reach the FortiGuard network.

First, check the License Information widget to make sure that the status of all FortiGuard services matches the services that you have purchased.

Go to System > FortiGuard. Expand Web Filtering and Email Filtering Options and select Test

Availability. After a minute, the GUI should indicate a successful connection.

13.

Consider changing the MAC address of your external interface.

Some ISPs do not want the MAC address of the device connecting to their network cable to change. If you have added a FortiGate to your network, you may have to change the MAC address of the Internet-facing interface using the following CLI command: config system interface edit <interface> end end set macaddr <xx:xx:xx:xx:xx:xx>

14. Either reset the FortiGate to factory defaults or contact Fortinet Support for assistance. See the note below before contacting support.

To reset the FortiGate to factory defaults, use the CLI command execute factoryreset. When prompted, type y to confirm the reset.

You can also contact Fortinet Support for assistance. Read the following article found on the Fortinet Cookbook website: How to work with Fortinet Support to understand what type of support is available and to determine which level of support is right for you. For further information, go to support.fortinet.com

.

Getting Started for FortiOS 5.6

Fortinet Technologies Inc.

31