Fortinet 800F manual Planning the FortiGate configuration, NAT/Route mode

Page 23

Getting started

NAT/Route mode

 

 

Planning the FortiGate configuration

Before you configure the FortiGate unit, you need to plan how to integrate the unit into the network. Among other things, you must decide whether you want the unit to be visible to the network, which firewall functions you want it to provide, and how you want it to control the traffic flowing between its interfaces.

Your configuration plan depends on the operating mode that you select. The FortiGate unit can be configured in one of two modes: NAT/Route mode (the default) or Transparent mode.

NAT/Route mode

In NAT/Route mode, the FortiGate unit is visible to the network. Like a router, all its interfaces are on different subnets. The following interfaces are available in NAT/Route mode:

External is the interface to the external network (usually the Internet).

Internal is the interface to the internal network.

DMZ is the interface to the DMZ network.

HA is the interface used to connect to other FortiGate-800/800F units if you are installing an HA cluster

Ports 1 to 4 can be connected to other networks.

You can add firewall policies to control whether communications through the FortiGate unit operate in NAT or Route mode. Firewall policies control the flow of traffic based on the source address, destination address, and service of each packet. In NAT mode, the FortiGate unit performs network address translation before it sends the packet to the destination network. In Route mode, there is no address translation.

You typically use NAT/Route mode when the FortiGate unit is operating as a gateway between private and public networks. In this configuration, you would create NAT mode firewall policies to control traffic flowing between the internal, private network and the external, public network (usually the Internet).

If you have multiple internal networks, such as a DMZ network in addition to the internal, private network, you could create route mode firewall policies for traffic flowing between them.

Figure 6: Example NAT/Route mode network configuration

 

 

 

Internal network

 

 

FortiGate-800 Unit

 

192.168.1.3

 

 

Internal

 

 

External

in NAT/Route mode

192.168.1.99

 

 

 

 

Route mode policies

Internet

204.23.1.5

 

 

8

EscEnter

 

controlling traffic between

 

 

 

 

internal networks.

 

 

 

DMZ

DMZ network

 

NAT mode policies controlling

10.10.10.1

 

 

traffic between internal and

external networks.10.10.10.2

FortiGate-800/800F Installation Guide

01-28006-0024-20041026

23

Image 23
Contents October 01-28006-0024-20041026 Installation GuideRegulatory Compliance TrademarksTable of Contents Index Introduction Secure installation, configuration, and managementWeb-based manager Command line interfaceDocument conventions Setup wizardFortiGate documentation FortiGate Installation GuideFortiMail documentation Related documentationFortiManager documentation FortiClient documentationComments on Fortinet technical documentation FortiLog documentationCustomer service and technical support Comments on Fortinet technical documentation Getting started Package contents Mounting To power off the FortiGate unit Turning the FortiGate unit power on and offConnecting to the web-based manager To connect to the web-based manager Connecting to the command line interface CLIWelcome To connect to the CLIFactory default NAT/Route mode network configuration Factory default FortiGate configuration settingsNetwork Settings Factory default Transparent mode network configurationFactory default protection profiles Factory default firewall configurationWeb protection profile settings NAT/Route mode Planning the FortiGate configurationTransparent mode NAT/Route mode with multiple external network connectionsFront control buttons and LCD Configuration optionsWeb-based manager and setup wizard Next steps Preparing to configure the FortiGate unit in NAT/Route mode NAT/Route mode installationDMZ Dhcp or PPPoE configurationTo configure interfaces Go to System Network Interface Using the web-based managerConfiguring basic settings Go to System Router Static Using the front control buttons and LCDTo configure DNS server settings Go to System Network DNS To add a default routeTo add/change the administrator password Using the command line interfaceConfiguring the FortiGate unit to operate in NAT/Route mode To add a default gateway to an interfaceExample To configure interfacesGet system interface To configure DNS server settingsOn page 28 and on page 29 for other settings Using the setup wizardDhcp server Starting the setup wizardFortiGate-800F Connecting the FortiGate unit to the networksFortiGate-800 To connect to FortiGate-800/800F user-defined interfaces To connect the FortiGate unit running in NAT/Route modeConfiguring the networks To register the FortiGate unit Go to System Config TimeTo set the date and time Go to System Maintenance Update Center To configure virus, attack, and spam definition updatesPreparing to configure Transparent mode Transparent mode installationTo change the Management IP Go to System Network Management To change the management IP address and netmask Reconnecting to the web-based managerTo configure the management IP address To add a default gatewayTo change to Transparent mode using the CLI End To configure the default gatewayTo start the setup wizard Connecting the FortiGate unit to your networkFortiGate-800F Internal Network Other Network To register your FortiGate unit Reconnecting to the web-based manager Priorities of heartbeat device and monitor priorities High availability installationConfiguring FortiGate units for HA operation High availability configuration settingsGroup ID MAC Address To change the FortiGate unit host name High availability settings ScheduleConfig system global Set hostname namestr end Configuring FortiGate units for HA using the CLITo configure the FortiGate unit for HA operation Connecting the cluster to your networksTo connect the cluster Internal Network Installing and configuring the clusterConfiguring FortiGate units for HA using the CLI CLI IndexIndex 01-28006-0024-20041026

800F, 800 specifications

Fortinet, a leader in cybersecurity solutions, has made significant strides in fortifying enterprise networks with its FortiGate 800 and 800F series. These next-generation firewalls are designed to deliver high performance and security for organizations seeking to protect their critical assets while ensuring optimal network efficiency.

The FortiGate 800 and 800F series are built on Fortinet's proprietary Security Fabric architecture, which provides a consolidated approach to security. This architecture allows organizations to leverage seamless integration across various security solutions and services, enhancing visibility and control. With a focus on scalability, these models support various deployment scenarios—from branch offices to data centers—making them versatile options for organizations of any size.

One of the standout features of the FortiGate 800 and 800F series is their robust threat intelligence capabilities. Powered by FortiGuard Labs, these firewalls provide real-time threat intelligence that enables proactive threat mitigation and incident response. This not only helps to defend against known threats but also enhances the firewall’s ability to identify emerging threats, ensuring comprehensive protection.

The series boasts impressive performance metrics. The FortiGate 800F can process up to 20 Gbps of firewall throughput and 1.5 million concurrent sessions, making it a suitable choice for high-performance environments. Additionally, the built-in SSL inspection capabilities allow organizations to decrypt and inspect encrypted traffic, which is crucial for detecting hidden threats.

The FortiGate 800 and 800F also feature advanced security technologies, including Intrusion Prevention System (IPS), antivirus, web filtering, and application control, all managed through a unified interface. This centralization simplifies management and reduces administrative overhead, allowing IT teams to focus on strategic initiatives.

Another significant characteristic of the FortiGate 800F is its energy efficiency. The design includes hardware optimizations that not only enhance performance but also reduce power consumption, aligning with the growing emphasis on sustainability practices.

In summary, the Fortinet FortiGate 800 and 800F series are comprehensive network security solutions that leverage advanced technologies to provide organizations with the security, performance, and flexibility necessary in today's threat landscape. With their robust threat intelligence and high throughput capabilities, these firewalls are well-suited for enterprises looking to fortify their defenses against an ever-evolving array of cyber threats.