Getting started

NAT/Route mode with multiple external network connections

 

 

You can add firewall policies to control whether communications through the FortiGate unit operate in NAT or Route mode. Firewall policies control the flow of traffic based on the source address, destination address, and service of each packet. In NAT mode, the FortiGate unit performs network address translation before it sends the packet to the destination network. In Route mode, there is no address translation.

You typically use NAT/Route mode when the FortiGate unit is operating as a gateway between private and public networks. In this configuration, you would create NAT mode firewall policies to control traffic flowing between the internal, private network and the external, public network (usually the Internet).

If you have multiple internal networks, such as a DMZ network in addition to the internal, private network, you could create route mode firewall policies for traffic flowing between them.

Figure 5: Example NAT/Route mode network configuration

Port 2

204.23.1.5

Internet

 

 

 

 

 

 

 

 

 

 

 

 

Internal network

 

FortiGate-500A Unit

 

 

 

 

 

 

 

192.168.1.3

 

 

 

 

Port 1

 

 

 

in NAT/Route mode

 

 

 

 

 

 

192.168.1.99

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Route mode policies

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

EscEnter

 

 

 

 

 

 

 

 

controlling traffic between

 

A

 

 

 

 

 

 

 

 

 

 

 

 

internal networks.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Port 4

 

 

 

 

 

 

 

 

 

 

DMZ network

NAT mode policies controlling

10.10.10.1

 

 

traffic between internal and

external networks. 10.10.10.2

NAT/Route mode with multiple external network connections

In NAT/Route mode, you can configure the FortiGate unit with multiple redundant connections to the external network (usually the Internet). For example, you could create the following configuration:

•LAN is the interface to the internal network.

•Port 1 is the default interface to the external network (usually the Internet).

•Port 2 is the redundant interface to the external network.

You must configure routing to support redundant Internet connections. Routing can be used to automatically redirect connections from an interface if its connection to the external network fails.

Otherwise, security policy configuration is similar to a NAT/Route mode configuration with a single Internet connection. You would create NAT mode firewall policies to control traffic flowing between the internal, private network and the external, public network (usually the Internet).

FortiGate-500A Installation Guide

01-28005-0101-20041015

21

Page 20 Page 22
Page 21
Image 21
Fortinet 500A, 127 NAT/Route mode with multiple external network connections, Example NAT/Route mode network configuration
Page 20 Page 22

500A, Network Router, 127, FORTIGATE specifications

Fortinet FortiGate 127 is an advanced network security appliance designed to deliver comprehensive protection to organizations while ensuring seamless network performance. As a part of Fortinet's leading next-generation firewall (NGFW) offerings, the FortiGate 127 integrates various essential features and technologies that are critical for modern network security.

One of the standout features of the FortiGate 127 is its ability to perform deep packet inspection. This technology enables the device to analyze and filter network traffic, identifying and mitigating threats such as malware, viruses, and intrusions in real-time. With a robust Threat Intelligence system, FortiGate utilizes FortiGuard Labs to provide continuous updates on emerging threats, equipping organizations with the necessary defense against sophisticated cyberattacks.

Another key technology included in the FortiGate 127 is integrated secure SD-WAN functionality. This feature allows organizations to optimize their wide-area network (WAN) connections, enhancing performance and reducing costs through intelligent traffic routing and real-time application visibility. By leveraging software-defined capabilities, businesses can ensure efficient use of their bandwidth, prioritize critical applications, and maintain high levels of uptime.

The FortiGate 127 also excels in providing advanced VPN support. With multiple VPN protocols such as IPsec and SSL, users can establish secure remote connections, facilitating safe access to corporate resources from anywhere. This is particularly important in today's remote work environment, where secure connectivity is essential for maintaining productivity while protecting sensitive data.

In terms of performance, the FortiGate 127 is equipped with high throughput capabilities, ensuring it can handle extensive network traffic without compromising speed or efficiency. Its multi-core architecture allows for parallel processing, which enhances overall performance and responsiveness.

Additionally, the device features an intuitive and user-friendly interface, enabling IT teams to easily manage and configure network policies. With centralized management options, administrators can efficiently oversee multiple FortiGate devices within their network, ensuring optimal visibility and control.

Overall, the Fortinet FortiGate 127 Network Router is a powerful solution for organizations seeking to bolster their security posture. With its combination of deep packet inspection, integrated SD-WAN functionality, advanced VPN support, and high-performance capabilities, it stands out as a vital asset in the modern cybersecurity landscape. It is an ideal choice for businesses aiming to protect their networks from the ever-evolving threat landscape while maintaining operational efficiency.
Top Page Image Contents