28
Fortinet Inc.
Planning your FortiGate configuration
Getting started
Planning your FortiGate configuration
Before beginning to configure the FortiGate unit, you need to plan how to integrate the
unit into your network. Among other things, you have to decide whether or not the unit
will be visible to the network, which firewall functions it will provide, and how it will
control the traffic flowing between its interfaces.
Your configuration plan is dependent upon the operating mode that you select. The
FortiGate unit can be configured in either of two modes: NAT/Route mode (the default)
or Transparent mode.
NAT/Route mode
In NAT/Route mode, the unit is visible to the network. Like a router, all of its interfaces
are on different subnets. The following interfaces are available in NAT/Route mode:
• External is the interface to the external network (usually the Internet).
• Internal is the interface to the internal network.
You can add security policies to control whether communications through the
FortiGate unit operate in NAT mode or in route mode. Security policies control the flow
of traffic based on each packet’s source address, destination address and service. In
NAT mode, the FortiGate performs network address translation before the packet is
sent to the destination network. In route mode, no translation takes place.
By default, the FortiGate unit has a NAT mode security policy that allows users on the
internal network to securely download content from the external network. No other
traffic is possible until you have configured more security policies.
You would typically use NAT/Route mode when the FortiGate unit is used as a
gateway between private and public networks. In this configuration, you would create
NAT mode policies to control traffic flowing between the internal, private network and
the external, public network (usually the Internet).
Figure 3: Example NAT/Route mode network configuration
Transparent mode
In Transparent mode, the FortiGate unit is invisible to the network. Similar to a
network bridge, all of FortiGate interfaces must be on the same subnet. You only have
to configure a management IP address so that you can make configuration changes.
The management IP address is also used for antivirus and attack definition updates.
You would typically use the FortiGate unit in Transparent mode on a private network
behind an existing firewall or behind a router. The FortiGate unit performs firewalling
as well as antivirus and content scanning but not VPN.
Summary of Contents for FortiGate FortiGate-50
Page 16: ...16 Fortinet Inc Customer service and technical support Introduction...
Page 32: ...32 Fortinet Inc Next steps Getting started...
Page 40: ...40 Fortinet Inc Completing the configuration NAT Route mode installation...
Page 112: ...112 Fortinet Inc Customizing replacement messages System configuration...
Page 144: ...144 Fortinet Inc Content profiles Firewall configuration...
Page 202: ...202 Fortinet Inc Logging attacks Network Intrusion Detection System NIDS...
Page 216: ...216 Fortinet Inc Exempt URL list Web filtering...
Page 228: ...228 Fortinet Inc Configuring alert email Logging and reporting...
Page 232: ...232 Fortinet Inc Glossary...