Fortinet FortiGate 1U, Quick Start Manual

Page: 31 / 272

Extra help: NAT/Route mode 11
7. Verify the DNS con fi gurations of the FortiGate unit and the PCs.
Check for DNS errors by pinging or using traceroute to connect to a domain name; for
example:
ping www.fortinet.com
ping: cannot resolve www.fre.com: Unknown host
If the name cannot be resolved, the FortiGate unit or PC cannot connect to a DNS server
and you should con
fi rm the DNS server IP addresses are present and correct.
8. Verify the security policy con fi guration.
Go to Policy > Policy > Policy and verify that an internal -> wan1 security policy has been
added and check the Session column to ensure that traf fi c has been processed. Check the
con fi guration of the policy to make sure that Enable NAT and Use Destination Interface
Address is selected.
9. Verify the static routing con fi guration.
Go to Router > Static > Static Routes and verify that the default route is correct. Go to
Router > Monitor > Router Monitor and verify that the default route appears in the list as
a static route. Along with the default route, you should see at least two connected routes,
one for each connected FortiGate interface.
On some FortiGate models, routing options are con fi gured by going to System > Network >
Routing or through the CLI.
10. Disable web fi ltering.
A web fi ltering security policy may block access to the website that you are attempting to
connect to. This could happen because the con fi guration of the default web fi lter pro fi le is
blocking access to the site.
It is also possible that FortiGuard Web Filtering has produced a rating error for the website,
causing the web
fi lter pro fi le to block access. A rating error could occur for a number of
reasons, including not being able to access FortiGuard. To fi x this problem, go to Security
Profiles > Web Filter > Profile and, in the default pro fi le, enable Allow Websites When
a Rating Error Occurs .
THE FOR
TIGA
TE COOKBOOK