Fortinet FortiGate FortiGate-3600 User manual

FortiGate 3600 Installation Guide
Esc Enter
POWER
Hi-Temp 4
123
5/HA INT EXT
123 4 5/HA INTERNAL EXTERNAL
Version 2.80 MR5
01 November 2004
01-28005-0027-20041101

© Copyright 2004 Fortinet Inc. All rights reserved.
No part of this publication including text, examples, diagrams or illustrations may be reproduced,
transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or
otherwise, for any purpose, without prior written permission of Fortinet Inc.
FortiGate-3600 Installation Guide
Version 2.80 MR5
01 November 2004
01-28005-0027-20041101
Trademarks
Products mentioned in this document are trademarks or registered trademarks of their respective
holders.
Regulatory Compliance
FCC Class A Part 15 CSA/CUS
CAUTION: RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE.
DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTIONS.
For technical support, please visit http://www.fortinet.com.
Send information about errors or omissions in this document or any Fortinet technical documentation to
[e-mail].

Contents
FortiGate-3600 Installation Guide 01-28005-0027-20041101 3
Table of Contents
Introduction ............................................................................................................ 5
Secure installation, configuration, and management .......................................................... 6
Web-based manager ...................................................................................................... 6
Command line interface .................................................................................................. 7
Setup wizard ................................................................................................................... 7
Document conventions ....................................................................................................... 7
Fortinet documentation ....................................................................................................... 9
Comments on Fortinet technical documentation............................................................. 9
Customer service and technical support........................................................................... 10
Getting started ..................................................................................................... 11
Package contents ............................................................................................................. 11
Mounting ........................................................................................................................... 12
Turning the FortiGate unit power on and off ..................................................................... 13
Connecting to the web-based manager ............................................................................ 14
Connecting to the command line interface (CLI)............................................................... 15
Factory default FortiGate configuration settings ............................................................... 16
Factory default NAT/Route mode network configuration .............................................. 17
Factory default Transparent mode network configuration............................................. 18
Factory default firewall configuration ............................................................................ 18
Factory default protection profiles................................................................................. 19
Planning the FortiGate configuration ................................................................................ 20
NAT/Route mode .......................................................................................................... 20
NAT/Route mode with multiple external network connections ...................................... 21
Transparent mode......................................................................................................... 22
Configuration options .................................................................................................... 23
Next steps ......................................................................................................................... 24
NAT/Route mode installation.............................................................................. 25
Preparing to configure the FortiGate unit in NAT/Route mode ......................................... 25
DHCP or PPPoE configuration ..................................................................................... 26
Using the web-based manager ......................................................................................... 27
Configuring basic settings............................................................................................. 27
Using the front control buttons and LCD........................................................................... 28
Using the command line interface..................................................................................... 29
Configuring the FortiGate unit to operate in NAT/Route mode ..................................... 29
Using the setup wizard...................................................................................................... 32
Starting the setup wizard .............................................................................................. 33
Reconnecting to the web-based manager .................................................................... 33
Connecting the FortiGate unit to the network(s) ............................................................... 33
Configuring the networks .................................................................................................. 35

Contents
401-28005-0027-20041101 Fortinet Inc.
Next steps ......................................................................................................................... 35
Transparent mode installation............................................................................ 37
Preparing to configure Transparent mode ........................................................................ 37
Using the web-based manager ......................................................................................... 38
Reconnecting to the web-based manager .................................................................... 39
Using the front control buttons and LCD........................................................................... 39
Using the command line interface..................................................................................... 40
Using the setup wizard...................................................................................................... 41
Reconnecting to the web-based manager .................................................................... 42
Connecting the FortiGate unit to your network ................................................................. 42
Next steps ......................................................................................................................... 43
High availability installation................................................................................ 45
Priorities of heartbeat device and monitor priorities...................................................... 45
Configuring FortiGate units for HA operation.................................................................... 45
High availability configuration settings .......................................................................... 45
Configuring FortiGate units for HA using the web-based manager .............................. 47
Configuring FortiGate units for HA using the CLI.......................................................... 48
Connecting the cluster to your networks........................................................................... 49
Installing and configuring the cluster................................................................................. 50
Index ...................................................................................................................... 53

FortiGate-3600 Installation Guide Version 2.80 MR5
FortiGate-3600 Installation Guide 01-28005-0027-20041101 5
Introduction
FortiGate Antivirus Firewalls improve network security, reduce network misuse and
abuse, and help you use communications resources more efficiently without
compromising the performance of your network. FortiGate Antivirus Firewalls are
ICSA-certified for firewall, IPSec, and antivirus services.
The FortiGate Antivirus Firewall is a dedicated easily managed security device that
delivers a full suite of capabilities that include:
• application-level services such as virus protection and content filtering,
• network-level services such as firewall, intrusion detection, VPN, and traffic
shaping.
The FortiGate Antivirus Firewall uses Fortinet’s Accelerated Behavior and Content
Analysis System (ABACAS™) technology, which leverages breakthroughs in chip
design, networking, security, and content analysis. The unique ASIC-based
architecture analyzes content and behavior in real-time, enabling key applications to
be deployed right at the network edge where they are most effective at protecting your
networks.
The FortiGate-3600 model provides the
carrier-class levels of performance and
reliability demanded by large enterprises
and service providers. The
FortiGate-3600 uses multiple CPUs and
FortiASIC chips to deliver throughput of 4Gbps, meeting the needs of the most
demanding applications. Each FortiGate-3600 unit includes redundant power supplies
to minimize single-point failures, and also supports load-balanced operation and
redundant failover with no interruption in service. The FortiGate-3600 includes one
10/100 BaseTX port, four Gigabit fibre ports, and two Gigabit ethernet ports. The high
capacity, reliability, and easy management of the FortiGate-3600 makes it a natural
choice for managed service offerings.
Esc Enter
POWER
Hi-Temp 4
123
5/HA INT EXT
123 4 5/HA INTERNAL EXTERNAL

601-28005-0027-20041101 Fortinet Inc.
Secure installation, configuration, and management Introduction
Secure installation, configuration, and management
The FortiGate unit default configuration includes default interface IP addresses and is
only a few steps away from protecting your network. There are several ways to
configure basic FortiGate settings:
• the web-based manager,
• the front panel control buttons and LCD,
• the command line interface (CLI), or
• the setup wizard.
The CLI or the web-based manager can then be used to complete configuration and
to perform maintenance and administration.
Web-based manager
Using HTTP or a secure HTTPS connection from any computer running Internet
Explorer, you can configure and manage the FortiGate unit. The web-based manager
supports multiple languages. You can configure the FortiGate unit for HTTP and
HTTPS administration from any FortiGate interface.
You can use the web-based manager to configure most FortiGate settings. You can
also use the web-based manager to monitor the status of the FortiGate unit.
Configuration changes made using the web-based manager are effective immediately
without resetting the firewall or interrupting service. Once you are satisfied with a
configuration, you can download and save it. The saved configuration can be restored
at any time.
Figure 1: Example of the FortiGate web-based manager login

Introduction Document conventions
FortiGate-3600 Installation Guide 01-28005-0027-20041101 7
Command line interface
You can access the FortiGate command line interface (CLI) by connecting a
management computer serial port to the FortiGate RS-232 serial console connector.
You can also use Telnet or a secure SSH connection to connect to the CLI from any
network that is connected to the FortiGate unit, including the Internet.
The CLI supports the same configuration and monitoring functionality as the
web-based manager. In addition, you can use the CLI for advanced configuration
options that are not available from the web-based manager.
This Installation Guide contains information about basic and advanced CLI
commands. For a more complete description about connecting to and using the
FortiGate CLI, see the FortiGate CLI Reference Guide.
Setup wizard
The FortiGate setup wizard provides an easy way to configure the basic initial settings
for the FortiGate unit. The wizard walks through the configuration of a new
administrator password, FortiGate interfaces, DHCP server settings, internal servers
(web, FTP, etc.), and basic antivirus settings.
Document conventions
This guide uses the following conventions to describe command syntax.
• Angle brackets < > to indicate variables.
For example:
execute restore config <filename_str>
You enter:
execute restore config myfile.bak
<xxx_str> indicates an ASCII string that does not contain new-lines or carriage
returns.
<xxx_integer> indicates an integer string that is a decimal (base 10) number.
<xxx_octet> indicates a hexadecimal string that uses the digits 0-9 and letters
A-F.
<xxx_ipv4> indicates a dotted decimal IPv4 address.
<xxx_v4mask> indicates a dotted decimal IPv4 netmask.
<xxx_ipv4mask> indicates a dotted decimal IPv4 address followed by a dotted
decimal IPv4 netmask.
<xxx_ipv6> indicates a dotted decimal IPv6 address.
<xxx_v6mask> indicates a dotted decimal IPv6 netmask.
<xxx_ipv6mask> indicates a dotted decimal IPv6 address followed by a dotted
decimal IPv6 netmask.

801-28005-0027-20041101 Fortinet Inc.
Document conventions Introduction
• Vertical bar and curly brackets {|} to separate alternative, mutually exclusive
required keywords.
For example:
set opmode {nat | transparent}
You can enter set opmode nat or set opmode transparent.
• Square brackets [ ] to indicate that a keyword or variable is optional.
For example:
show system interface [<name_str>]
To show the settings for all interfaces, you can enter show system interface.
To show the settings for the internal interface, you can enter show system
interface internal.
• A space to separate options that can be entered in any combination and must be
separated by spaces.
For example:
set allowaccess {ping https ssh snmp http telnet}
You can enter any of the following:
set allowaccess ping
set allowaccess ping https ssh
set allowaccess https ping ssh
set allowaccess snmp
In most cases to make changes to lists that contain options separated by spaces,
you need to retype the whole list including all the options you want to apply and
excluding all the options you want to remove.

Introduction Fortinet documentation
FortiGate-3600 Installation Guide 01-28005-0027-20041101 9
Fortinet documentation
Information about FortiGate products is available from the following FortiGate User
Manual volumes:
•FortiGate QuickStart Guide
Each QuickStart Guide provides the basic information required to connect and
install a FortiGate model.
•FortiGate Installation Guide
Each Installation Guide provides detailed information required to install a FortiGate
model. Includes hardware reference, default configuration, installation procedures,
connection procedures, and basic configuration procedures.
•FortiGate Administration Guide
Each Administration Guide describes how to configure a FortiGate model.
Configuration information includes how to use FortiGate firewall policies to control
traffic flow through the FortiGate unit and how to configure VPN, IPS, antivirus,
web filtering, spam filtering. The administration guide also describes how to use
protection profiles to apply intrusion prevention, antivirus protection, web content
filtering, and spam filtering to traffic passing through the FortiGate unit.
•FortiGate CLI Reference Guide
Describes how to use the FortiGate CLI and contains a reference to all FortiGate
CLI commands.
•FortiGate Log Message Reference Guide
Describes the structure of FortiGate log messages and provides information on all
log messages generated by the FortiGate unit.
• FortiGate High Availability Guide
Contains in-depth information about FortiGate High Availability and the FortiGate
Clustering Protocol (FGCP).
The FortiGate online help also contains procedures for using the FortiGate web-based
manager to configure and manage the FortiGate unit. For a complete list of FortiGate
documentation visit Fortinet Technical Support at http://support.fortinet.com.
Comments on Fortinet technical documentation
You can send information about errors or omissions in this document, or any Fortinet
technical documentation, to [email protected].

10 01-28005-0027-20041101 Fortinet Inc.
Customer service and technical support Introduction
Customer service and technical support
For antivirus and attack definition updates, firmware updates, updated product
documentation, technical support information, and other resources, please visit the
Fortinet technical support web site at http://support.fortinet.com.
You can also register FortiGate Antivirus Firewalls from http://support.fortinet.com and
change your registration information at any time.
Fortinet email support is available from the following addresses:
For information on Fortinet telephone support, see http://support.fortinet.com.
When requesting technical support, please provide the following information:
• Your name
• Company name
•Location
• Email address
• Telephone number
• FortiGate unit serial number
• FortiGate model
• FortiGate FortiOS firmware version
• Detailed description of the problem
[e-mail] For customers in the United States, Canada, Mexico, Latin
America and South America.
apac_suppo[email protected] For customers in Japan, Korea, China, Hong Kong, Singapore,
Malaysia, all other Asian countries, and Australia.
[e-mail] For customers in the United Kingdom, Scandinavia, Mainland
Europe, Africa, and the Middle East.

FortiGate-3600 Installation Guide Version 2.80 MR5
FortiGate-3600 Installation Guide 01-28005-0027-20041101 11
Getting started
This section describes unpacking, setting up, and powering on a FortiGate Antivirus
Firewall unit. This section includes:
•Package contents
•Mounting
•Turning the FortiGate unit power on and off
•Connecting to the web-based manager
•Connecting to the command line interface (CLI)
•Factory default FortiGate configuration settings
•Planning the FortiGate configuration
•Next steps
Package contents
The FortiGate-3600 package contains the following items:
• FortiGate-3600 Antivirus Firewall
• one red crossover ethernet cable (Fortinet part number CC300248)
• one gray regular ethernet cable (Fortinet part number CC300249)
• one null modem cable (Fortinet part number CC300247)
• FortiGate-3600 QuickStart Guide
• two power cables
• CD containing the FortiGate user documentation

12 01-28005-0027-20041101 Fortinet Inc.
Mounting Getting started
Figure 2: FortiGate-3600 package contents
Mounting
The FortiGate-3600 unit can be mounted in a standard 19-inch rack. It requires 2 U of
vertical space in the rack.
The FortiGate-3600 unit can also be installed as a free-standing appliance on any
stable surface.
Dimensions
• 16.75 x 13.5 x 3.5 in. (42.7 x 33 x 8.9 cm)
Weight
• 17.5 lb. (8 kg)
Power requirements
• Power dissipation: 460 W (max)
• AC input voltage: 100 to 240 VAC
• AC input current: 6 A
• Frequency: 50 to 60 Hz
• The FortiGate-1000 unit may overload your supply circuit and impact your
overcurrent protection and supply wiring. Use appropriate equipment nameplate
ratings to address this concern.
• Make sure that the FortiGate-1000 unit has reliable earthing. Fortinet recommends
direct connections to the branch circuit.
Esc Enter
POWER
Hi-Temp 4
123
5/HA INT EXT
123 4 5/HA INTERNAL EXTERNAL
Front
Back
Power Cables (2)
Rack-Mount Brackets
Null-Modem Cable
(RS-232)
Documentation
Ethernet Cables:
Orange - Crossover
Grey - Straight-through
USER MANUAL
FortiGate-3600
QuickStart Guide
Copyright 2003 Fortinet Incorporated. All rights reserved.
Trademarks
Products mentioned in this document are trademarks.
LCD
Display
Control
Buttons
1, 2, 3, 4, 5/HA
Interfaces
Internal
Interface
External
Interface
12345/HA
POWER
Hi-Temp 4
123
5/HA INT EXT
INTERNALEXTERNAL
Esc Enter
RS-232 Serial
Connection
Redundant
Hot Swappable
Power Supplies
Redundant
Hot-Swappable
Fan Assemblies
Power
Supply
LEDs
Alarm
Cancel
Button

Getting started Turning the FortiGate unit power on and off
FortiGate-3600 Installation Guide 01-28005-0027-20041101 13
Environmental specifications
• Operating temperature: 32 to 104°F (0 to 40°C)
• Storage temperature: -13 to 158°F (-25 to 70°C)
• Humidity: 5 to 95% non-condensing
• If you install the FortiGate-3600 unit in a closed or multi-unit rack assembly, the
operating ambient temperature of the rack environment may be greater than room
ambient. Make sure the operating ambient temperature does not exceed the
manufacturer's maximum rated ambient temperature.
Air flow
• For rack installation, make sure that the amount of air flow required for safe
operation of the FortiGate unit is not compromised.
• For free-standing installation, make sure that the FortiGate unit has at least 1.5 in.
(3.75 cm) of clearance on each side to allow for adequate air flow and cooling.
Mechanical loading
• For rack installation, make sure the mechanical loading of the FortiGate unit is
evenly distributed to avoid a hazardous condition.
Turning the FortiGate unit power on and off
To power on the FortiGate unit
1Connect the power cables to the power connections on the back of the FortiGate unit.
2Connect the power cables to power outlets.
Connect each power cable to a different power source, if possible. If one power
source fails, the other source might still be operative.
After a few seconds, SYSTEM STARTING appears
on the LCD.
MAIN MENU appears on the LCD when the system
is running.
Note: If only one power supply is connected, an audible alarm sounds to indicate a failed power
supply. To stop this alarm, press the red alarm cancel button on the rear panel next to the power
supplies.

14 01-28005-0027-20041101 Fortinet Inc.
Connecting to the web-based manager Getting started
To power off the FortiGate unit
Always shut down the FortiGate operating system properly before turning off the
power switch.
1From the web-based manager, go to System > Maintenance > ShutDown, select
Shut Down and select Apply, or from the CLI, enter:
execute shutdown
2Disconnect the power cables from the power supply.
Connecting to the web-based manager
Use the following procedure to connect to the web-based manager for the first time.
Configuration changes made with the web-based manager are effective immediately
without resetting the firewall or interrupting service.
To connect to the web-based manager, you need:
• a computer with an ethernet connection,
• Internet Explorer version 4.0 or higher,
• a crossover cable or an ethernet hub and two ethernet cables.
Table 1: FortiGate-3600 LED indicators
LED State Description
Power Green The FortiGate unit is powered on.
Off The FortiGate unit is powered off.
1, 2, 3, 4
5/HA, INT, EXT
(left side of
faceplate)
Green The correct cable is in use, and the connected equipment has
power.
Flashing
green
Network activity at this interface.
Off No link established.
1
(10/100
interface)
Green The correct cable is in use, and the connected equipment has
power.
Flashing
green
Network activity at this interface.
Green The interface is connected at 100 Mbps.
Off No link established.
Internal
External
(gigabit copper
interfaces)
Amber The correct cable is in use, and the connected equipment has
power.
Flashing
amber
Network activity at this interface.
Green The interface is connected at 1000 Mbps.
Off No link established.
Note: You can use the web-based manager with recent versions of most popular web
browsers. The web-based manager is fully supported for Internet Explorer version 4.0 or higher.

Getting started Connecting to the command line interface (CLI)
FortiGate-3600 Installation Guide 01-28005-0027-20041101 15
To connect to the web-based manager
1Set the IP address of the computer with an ethernet connection to the static IP
address 192.168.1.2 with a netmask of 255.255.255.0.
2Using the crossover cable or the ethernet hub and cables, connect the internal
interface of the FortiGate unit to the computer ethernet connection.
3Start Internet Explorer and browse to the address https://192.168.1.99. (remember to
include the “s” in https://).
The FortiGate login is displayed.
4Type admin in the Name field and select Login.
The Register Now window is displayed. It is important to register the Fortigate unit so
that Fortinet can contact the unit for firmware updates. You must register to receive
updates to the FortiGate antivirus and attack definitions.
Figure 3: Example FortiGate login
Connecting to the command line interface (CLI)
As an alternative to the web-based manager, you can install and configure the
FortiGate unit using the CLI. Configuration changes made with the CLI are effective
immediately without resetting the firewall or interrupting service.
To connect to the FortiGate CLI, you need:
• a computer with an available communications port,
• the null modem cable included in your FortiGate package,
• terminal emulation software such as HyperTerminal for Windows.

16 01-28005-0027-20041101 Fortinet Inc.
Factory default FortiGate configuration settings Getting started
To connect to the CLI
1Connect the null modem cable to the communications port of your computer and to
the FortiGate Console port.
2Make sure that the FortiGate unit is powered on.
3Start HyperTerminal, enter a name for the connection, and select OK.
4Configure HyperTerminal to connect directly to the communications port on your
computer and select OK.
5Select the following port settings and select OK.
6Press Enter to connect to the FortiGate CLI.
The following prompt is displayed:
FortiGate-3600 login:
7Type admin and press Enter twice.
The following prompt is displayed:
Welcome !
Type ? to list available commands. For information about how to use the CLI, see the
FortiGate CLI Reference Guide.
Factory default FortiGate configuration settings
The FortiGate unit is shipped with a factory default configuration. The default
configuration allows you to connect to and use the FortiGate web-based manager to
configure the FortiGate unit onto the network. To configure the FortiGate unit onto the
network you add an administrator password, change network interface IP addresses,
add DNS server IP addresses, and configure basic routing, if required.
If you plan to operate the FortiGate unit in Transparent mode, you can switch to
Transparent mode from the factory default configuration and then configure the
FortiGate unit onto the network in Transparent mode.
Once the network configuration is complete, you can perform additional configuration
tasks such as setting system time, configuring virus and attack definition updates, and
registering the FortiGate unit.
Note: The following procedure describes how to connect to the CLI using Windows
HyperTerminal software. You can use any terminal emulation program.
Bits per second 9600
Data bits 8
Parity None
Stop bits 1
Flow control None

Getting started Factory default FortiGate configuration settings
FortiGate-3600 Installation Guide 01-28005-0027-20041101 17
The factory default protection profiles can be used to apply different levels of antivirus
protection, web content filtering, spam filtering, and IPS to the network traffic that is
controlled by firewall policies.
•Factory default NAT/Route mode network configuration
•Factory default Transparent mode network configuration
•Factory default firewall configuration
•Factory default protection profiles
Factory default NAT/Route mode network configuration
When the FortiGate unit is first powered on, it is running in NAT/Route mode and has
the basic network configuration listed in Tabl e 2. This configuration allows you to
connect to the FortiGate unit web-based manager and establish the configuration
required to connect the FortiGate unit to the network. In Ta ble 2, HTTPS
administrative access means you can connect to the web-based manager using
HTTPS protocol through this interface. Ping administrative access means this
interface responds to ping requests.
Table 2: Factory default NAT/Route mode network configuration
Administrator
account
User name: admin
Password: (none)
Internal interface
IP: 192.168.1.99
Netmask: 255.255.255.0
Administrative Access: HTTPS, Ping
External Interface
IP: 192.168.100.99
Netmask: 255.255.255.0
Administrative Access: Ping
Port 1
IP: 0.0.0.0
Netmask: 0.0.0.0
Administrative Access: Ping
Port 2
IP: 0.0.0.0
Netmask: 0.0.0.0
Administrative Access: Ping
Port 3
IP: 0.0.0.0
Netmask: 0.0.0.0
Administrative Access: Ping
Port 4
IP: 0.0.0.0
Netmask: 0.0.0.0
Administrative Access: Ping
Port 5/HA
IP: 0.0.0.0
Netmask: 0.0.0.0
Administrative Access: Ping

18 01-28005-0027-20041101 Fortinet Inc.
Factory default FortiGate configuration settings Getting started
Factory default Transparent mode network configuration
In Transparent mode, the FortiGate unit has the default network configuration listed in
Tabl e 3 .
Factory default firewall configuration
FortiGate firewall policies control how all traffic is processed by the FortiGate unit.
Until firewall policies are added, no traffic can be accepted by or pass through the
FortiGate unit. To allow traffic through the FortiGate unit you can add firewall policies.
See the FortiGate Administration Guide for information about adding firewall policies.
The following firewall configuration settings are included in the default firewall
configuration to make it easier to add firewall policies.
Network Settings
Default Gateway (for default route) 192.168.100.1
Interface connected to external network
(for default route)
external
Default Route
A default route consists of a default gateway and the name of
the interface connected to the external network (usually the
Internet). The default gateway directs all non-local traffic to this
interface and to the external network.
Primary DNS Server 207.192.200.1
Secondary DNS Server 207.192.200.129
Table 2: Factory default NAT/Route mode network configuration (Continued)
Table 3: Factory default Transparent mode network configuration
Administrator
account
User name: admin
Password: (none)
Management IP IP: 10.10.10.1
Netmask: 255.255.255.0
DNS Primary DNS Server: 207.194.200.1
Secondary DNS Server: 207.194.200.129
Administrative access
Internal HTTPS, Ping
External Ping
Port 1 Ping
Port 2 Ping
Port 3 Ping
Port 4 Ping
Port 5/HA Ping

Getting started Factory default FortiGate configuration settings
FortiGate-3600 Installation Guide 01-28005-0027-20041101 19
The factory default firewall configuration is the same in NAT/Route and Transparent
mode.
Factory default protection profiles
Use protection profiles to apply different protection settings for traffic that is controlled
by firewall policies. You can use protection profiles to:
• Configure antivirus protection for HTTP, FTP, IMAP, POP3, and SMTP firewall
policies
• Configure Web filtering for HTTP firewall policies
• Configure Web category filtering for HTTP firewall policies
• Configure spam filtering for IMAP, POP3, and SMTP firewall policies
• Enable the Intrusion Protection System (IPS) for all services
• Enable content logging for HTTP, FTP, IMAP, POP3, and SMTP firewall policies
Using protection profiles, you can build protection configurations that can be applied
to different types of firewall policies. This allows you to customize types and levels of
protection for different firewall policies.
For example, while traffic between internal and external addresses might need strict
protection, traffic between trusted internal addresses might need moderate protection.
You can configure firewall policies for different traffic services to use the same or
different protection profiles.
Protection profiles can be added to NAT/Route mode and Transparent mode firewall
policies.
The FortiGate unit comes preconfigured with four protection profiles.
Table 4: Default firewall configuration
Configuration setting Name Description
Firewall address All Firewall address matches the source or
destination address of any packet.
Pre-defined service More than 50
predefined services
Select from any of the 50 pre-defined services
to control traffic through the FortiGate unit that
uses that service.
Recurring schedule Always The recurring schedule is valid at any time.
Protection Profiles Strict, Scan, Web,
Unfiltered
Control how the FortiGate unit applies virus
scanning, web content filtering, spam filtering,
and IPS.
Strict To apply maximum protection to HTTP, FTP, IMAP, POP3, and SMTP
traffic. You may not use the strict protection profile under normal
circumstances but it is available if you have problems with viruses and
require maximum screening.
Scan To apply antivirus scanning to HTTP, FTP, IMAP, POP3, and SMTP content
traffic. Quarantine is also selected for all content services. On FortiGate
models with a hard drive, if antivirus scanning finds a virus in a file, the file is
quarantined on the FortiGate local disk. If required, system administrators
can recover quarantined files.

20 01-28005-0027-20041101 Fortinet Inc.
Planning the FortiGate configuration Getting started
Figure 4: Web protection profile settings
Planning the FortiGate configuration
Before you configure the FortiGate unit, you need to plan how to integrate the unit into
the network. Among other things, you must decide whether you want the unit to be
visible to the network, which firewall functions you want it to provide, and how you
want it to control the traffic flowing between its interfaces.
Your configuration plan depends on the operating mode that you select. The FortiGate
unit can be configured in one of two modes: NAT/Route mode (the default) or
Transparent mode.
NAT/Route mode
In NAT/Route mode, the FortiGate unit is visible to the network. Like a router, all its
interfaces are on different subnets. The following interfaces are available in
NAT/Route mode:
• External is the interface to the external network (usually the Internet).
• Internal is the interface to the internal network.
• Ports 1, 3, and 4 can be connected to any networks.
• Port 2 can be connected to a DMZ network or to any other network.
• Port 5/HA can be connected to another network. Port 5/HA can also be connected
to other FortiGate-3600s if you are installing an HA cluster.
Web To apply antivirus scanning and web content blocking to HTTP content
traffic. You can add this protection profile to firewall policies that control
HTTP traffic.
Unfiltered To apply no scanning, blocking or IPS. Use if you do not want to apply
content protection to content traffic. You can add this protection profile to
firewall policies for connections between highly trusted or highly secure
networks where content does not need to be protected.