Fortinet FortiGate FortiGate-5005-DIST User manual

www.fortinet.com
FortiGate-5005-DIST Security System Getting Started
01-30000-0414-20070615
FortiGate-5005-DIST Security System
Getting Started
This FortiGate-5005-DIST Security System Getting Started describes how to install FortiGate-5005-DIST security
system hardware components and how to configure a FortiGate-5005-DIST system onto your network.
The most recent versions of this and all FortiGate-5000 series documents are available from the FortiGate-5000
page of the Fortinet Technical Documentation web site (http://docs.forticare.com).
Visit http://support.fortinet.com to register your FortiGate-5005-DIST Security System. By registering you can receive
product updates, technical support, and FortiGuard services.
1
2
2
3
4
5
SMC
1
SMC
POWER
5050SAP
SERIAL
1SERIAL 2
ALARM
10/100
link/Act
ETH0
Service
RESET
STATUS
HotSwap
link/Act
ETH0 ETH1
10/100
5000SM
10/100
link/Act
ETH0
Service
RESET
STATUS
HotSwap
link/Act
ETH0 ETH1
10/100
5000SM
PAYLOADOPERATION
STATUS IPM
X 1
X 2
1/2 3/4 D15/D16 C15/C16
1
2
3
4
5
6
7
8
9
10
11
12
D
13
14
15
16
D
1
2
3
4
5
6
7
8
9
10
11
12
C
13
14
15
16
C
10/100/1000 MBPS ETHERNET ACTIVITY
DATA CONTROL 1
2
3
4
MANAGEMENT COM 1 COM 2
X 1 X 2
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
FAN TRAY FAN TRAYFAN TRAY
1311975312468101214
5140
CRITICAL
RESET
MAJOR
MINOR
USER1
USER2
USER3
5140SAP
SERIAL1 SERIAL2 ALARM
FILTER
12
012
10/100
link/Act
ETH0
Service
RESET
STATUS
HotSwap
link/Act
ETH0 ETH1
10/100
5000SM
10/100
link/Act
ETH0
Service
RESET
STATUS
HotSwap
link/Act
ETH0 ETH1
10/100
5000SM
PAYLOADOPERATION
STATUS IPM
X 1
X 2
1/2 3/4 D15/D16 C15/C16
1
2 3 4
5
6 7 8
9
10 11 12
D
13
14 15 16
D
1
2 3 4
5
6 7 8
9
10 11 12
C
13
14 15 16
C
10/100/1000 MBPS ETHERNET ACTIVITY
DATA CONTROL 1
2 3 4
MANAGEMENT COM 1 COM 2
X 1 X 2
PAYLOADOPERATION
STATUS IPM
X 1
X 2
1/2 3/4 D15/D16 C15/C16
1
2 3 4
5
6 7 8
9
10 11 12
D
13
14 15 16
D
1
2 3 4
5
6 7 8
9
10 11 12
C
13
14 15 16
C
10/100/1000 MBPS ETHERNET ACTIVITY
DATA CONTROL 1
2 3 4
MANAGEMENT COM 1 COM 2
X 1 X 2
CONSOLE
ACT ACT
LINK LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT ACT
LINK LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT ACT
LINK LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT ACT
LINK LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT ACT
LINK LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT ACT
LINK LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM

FortiGate-5005-DIST Security System Getting Started
01-30000-0414-20070615
Warnings and cautions
Only trained and qualified personnel should be allowed to install or maintain FortiGate-5000 series
equipment. Read and comply with all warnings, cautions and notices in this document.
• Turning off all power switches may not turn off all power to the FortiGate-5000 series equipment.
Except where noted, disconnect the FortiGate-5000 series equipment from all power sources,
telecommunications links and networks before installing, or removing FortiGate-5000 series
components, or performing other maintenance tasks. Failure to do this can result in personal injury or
equipment damage. Some circuitry in the FortiGate-5000 series equipment may continue to operate
even though all power switches are off.
• An easily accessible disconnect device, such as a circuit breaker, should be incorporated into the data
center wiring that connects power to the FortiGate-5000 series equipment.
• Install FortiGate-5000 series chassis at the lower positions of a rack to avoid making the rack top-heavy
and unstable.
• Do not insert metal objects or tools into open chassis slots.
• Electrostatic discharge (ESD) can damage FortiGate-5000 series equipment. Only perform the
procedures described in this document from an ESD workstation. If no such station is available, you
can provide some ESD protection by wearing an anti-static wrist or ankle strap and attaching it to an
ESD connector or to a metal part of a FortiGate chassis.
• Some FortiGate-5000 series components may overload your supply circuit and impact your overcurrent
protection and supply wiring. Refer to nameplate ratings to address this concern.
• Make sure all FortiGate-5000 series components have reliable grounding. Fortinet recommends direct
connections to the branch circuit.
• If you install a FortiGate-5000 series component in a closed or multi-unit rack assembly, the operating
ambient temperature of the rack environment may be greater than room ambient. Make sure the
operating ambient temperature does not exceed the manufacturer's maximum rated ambient
temperature.
• Installing FortiGate-5000 series equipment in a rack should be such that the amount of airflow required
for safe operation of the equipment is not compromised.
• This equipment is for installation only in a Restricted Access Location (dedicated equipment room,
service closet or the like), in accordance with the National Electrical Code.
• Per the National Electrical Code, sizing of a Listed circuit breaker or branch circuit fuse and the supply
conductors to the equipment is based on the marked input current rating. A product with a marked input
current rating of 25 A is required to be placed on a 40 A branch circuit. The supply conductors will also
be sized according to the input current rating and also derated for the maximum rated operating
ambient temperature, Tma, of the equipment.
• FortiGate-5000 series equipment shall be installed and connected to an electrical supply source in
accordance with the applicable codes and regulations for the location in which it is installed. Particular
attention shall be paid to use of correct wire type and size to comply with the applicable codes and
regulations for the installation / location. Connection of the supply wiring to the terminal block on the
equipment may be accomplished using Listed wire compression lugs, for example, Pressure Terminal
Connector made by Ideal Industries Inc. or equivalent which is suitable for AWG 10. Particular attention
shall be given to use of the appropriate compression tool specified by the compression lug
manufacturer, if one is specified.
!CAUTION: Risk of Explosion if Battery is replaced by an Incorrect Type. Dispose of Used Batteries According
to the Instructions.
!Caution: You should be aware of the following cautions and warnings before installing FortiGate-5000 series
hardware

Contents
FortiGate-5005-DIST Security System Version 3.0 MR2 Getting Started
01-30000-0414-20070615 3
Contents
Warnings and cautions..................................................................................... 2
The FortiGate-5005-DIST Security System...................... 5
Basic FortiGate security system configuration.............................................. 5
FortiController-5208 I/O modules..................................................................... 6
FortiGate-5005FA2 worker modules ................................................................ 7
FortiGate-5005-DIST security system chassis................................................ 7
FortiGate-5140 chassis................................................................................. 8
FortiGate-5050 chassis................................................................................. 8
FortiGate-5005-DIST interface names.............................................................. 9
Installing hardware components.................................... 11
Getting started................................................................................................. 11
Installing the chassis ...................................................................................... 12
Installing FortiController-5208 modules........................................................ 12
Installing FortiController-5208 modules ...................................................... 13
Connecting to the FortiController-5208 CLI or web-based manager .......... 13
Configuring the primary I/O module ............................................................ 14
Installing FortiGate-5005FA2 worker modules ............................................. 15
Installing FortiGate-5005FA2 modules........................................................ 16
Verifying that FortiGate-5005FA2 modules can communicate with the primary
I/O module................................................................................................... 16
Installing DIST firmware on a FortiGate-5005FA2 module ......................... 19
Quick Configuration Guide ............................................. 23
Planning the configuration............................................................................. 23
NAT/Route mode ........................................................................................ 23
Transparent mode....................................................................................... 24
Choosing the configuration tool.................................................................... 25
Web-based manager................................................................................... 25
Command Line Interface (CLI).................................................................... 25
Factory default settings.................................................................................. 26
Configuring NAT/Route mode........................................................................ 27
Using the web-based manager to configure NAT/Route mode................... 28
Using the CLI to configure NAT/Route mode.............................................. 28
Configuring Transparent mode...................................................................... 29
Using the web-based manager to configure Transparent mode................. 30
Using the CLI to configure Transparent mode ............................................ 31
Powering off the FortiGate-5005-DIST system.............................................. 31

FortiGate-5005-DIST Security System Version 3.0 MR2 Getting Started
401-30000-0414-20070615
Contents
Hardware procedures...................................................... 33
Starting a configured FortiGate-5005-DIST system ..................................... 33
Installing FortiGate-5005-DIST firmware....................................................... 33
Viewing the currently installed firmware versions ....................................... 34
Upgrading I/O module firmware.................................................................. 34
Upgrading worker module firmware installed on the primary I/O module ... 36
Upgrading FortiController-5208 NPU firmware............................................. 37
For more information ...................................................... 39
Fortinet documentation .................................................................................. 39
Fortinet Tools and Documentation CD........................................................ 39
Fortinet Knowledge Center ........................................................................ 39
Comments on Fortinet technical documentation ........................................ 39
Customer service and technical support...................................................... 39
Register your Fortinet product....................................................................... 39

The FortiGate-5005-DIST Security System Basic FortiGate security system configuration
FortiGate-5005-DIST Security System Getting Started
01-30000-0414-20070615 5
The FortiGate-5005-DIST Security
System
The FortiGate-5005-DIST security system is very similar to a single FortiGate unit,
but with much higher capacity and with support for failover protection and
scalability. The FortiGate-5005-DIST security system consists of a FortiGate-5050
or FortiGate-5140 chassis with one or two Input/Output or I/O modules
(FortiController-5208 modules) and one or more worker modules
(FortiGate-5005FA2 modules running in DIST mode). The I/O modules provide
network connections and distribute traffic to the worker modules. The worker
modules provide FortiGate security system functions including firewall, VPN, IPS,
antivirus, antispam, and so on.
The following topics are included in this section:
•Basic FortiGate security system configuration
•FortiController-5208 I/O modules
•FortiGate-5005FA2 worker modules
•FortiGate-5005-DIST security system chassis
•FortiGate-5005-DIST interface names
Basic FortiGate security system configuration
A basic FortiGate security system consists of a single FortiController-5208
module and four FortiGate-5005 modules installed in a FortiGate-5050 or
FortiGate-5140 chassis (see Figure 1 on page 6). This system can be installed in
NAT/Route mode between the Internet and a private network. In this
configuration, the FortiGate-5005-DIST security system can provide FortiGate
services to 10 gigabit traffic passing between the private network and the Internet.

FortiGate-5005-DIST Security System Getting Started
601-30000-0414-20070615
FortiController-5208 I/O modules The FortiGate-5005-DIST Security System
Figure 1: Example basic FortiGate-5005-DIST security system
FortiController-5208 I/O modules
Data flows into and out of the FortiGate-5005-DIST system through the I/O
modules. The I/O modules are FortiController-5208 modules installed in chassis
slots 1 and 2 in a FortiGate-5050 or FortiGate-5140 chassis. The I/O module
installed in slot 1 is configured as the primary I/O module. The optional I/O module
installed in slot 2 becomes the secondary I/O module. A FortiGate-5005-DIST
system can include one or two I/O modules.
As the I/O module, the FortiController-5208 provides all FortiGate-5005-DIST
network connections. The FortiController-5208 module provides two 10 gigabit
interfaces and four 1 gigabit interfaces for network traffic. The FortiController-5208
front panel also contains four 1 gigabit interfaces. Two of these interfaces support
inter-chassis HA and two are for future use. Adding a second FortiController-5208
module doubles the number of FortiGate-5005-DIST network interfaces.
Figure 2: FortiController-5208 front panel
1
2
2
3
4
5
SMC
1
SMC
POWER
5050SAP
SERIAL
1SERIAL 2
ALARM
10/100
link/Act
ETH0
Service
RESET
STATUS
HotSwap
link/Act
ETH0 ETH1
10/100
5000SM
10/100
link/Act
ETH0
Service
RESET
STATUS
HotSwap
link/Act
ETH0 ETH1
10/100
5000SM
PAYLOADOPERATION
STATUS IPM
X1
X2
1/2 3/4 D15/D16 C15/C16
1
2
3
4
5
6
7
8
9
10
11
12
D
13
14
15
16
D
1
2
3
4
5
6
7
8
9
10
11
12
C
13
14
15
16
C
10/100/1000MBPS ETHERNET ACTIVITY
DATA CONTROL 1
2
3
4
MANAGEMENT COM1 COM2
X1 X2
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
NAT mode policies
controlling 10G traffic
between internal and
external networks.
X2 (port1_X2)
204.23.1.5
X1 (port1_X1)
192.168.1.99
Management
interface (mng)
FortiGate-5005-DIST
security system in
NAT/Route mode
Internet
Internal
network
PAYLOAD OPERATION
STATUS IPM
X 1
X 2
1/2 3/4 D15/D16 C15/C16
1
2
3
4
5
6
7
8
9
10
11
12
D
13
14
15
16
D
1
2
3
4
5
6
7
8
9
10
11
12
C
13
14
15
16
C
10/100/1000 MBPS ETHERNET ACTIVITY
DATA CONTROL 1
2
3
4
MANAGEMENT COM 1 COM 2
X 1 X 2
SFP Gigabit
Fiber or Copper
13
42
Management
RJ-45 Serial
Extraction
Lever
IPM
Status
X1 X2 XFP 10 Gigabit
Fiber or Copper
Payload
Operation
Link/
Traf fic
Extraction
Lever
Mounting
Knot
Mounting
Knot
Link/Traffic
D15
D16
C15
C16
Management
RJ-45 Ethernet

The FortiGate-5005-DIST Security System FortiGate-5005FA2 worker modules
FortiGate-5005-DIST Security System Getting Started
01-30000-0414-20070615 7
FortiGate-5005FA2 worker modules
The FortiGate-5005FA2 security system serves as the worker module for the
FortiGate-5005-DIST security system. Worker modules are identically configured
and administered as a single unit from the primary I/O module. Workers are
typically installed in slots 3 and above, though FortiGate-5005FA2 security
systems with only one I/O module can also have a worker installed in slot 2.
The worker modules apply all of the FortiGate security system functionality to
traffic passing through the FortiGate-5005-DIST security system. Traffic is
distributed to the worker modules by the I/O modules. The worker modules
perform FortiGate functions such as applying firewall policies, virus scanning, IPS
and routing to distributed traffic.
Figure 3: FortiGate-5005FA2 front panel
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
1 2 3 4 5 6 SPF Gigabit
Fiber or Copper
7 8 SPF Gigabit
Fiber or Copper
Accelerated
Extraction
Lever
Out
of
Service Module
Position
Status
USB
Fabric and Base
network activity
LEDs
Flash Disk
Access
RJ-45
Serial
Extraction
Lever
Mounting
Knot
Mounting
Knot
Link/Traffic

FortiGate-5005-DIST Security System Getting Started
801-30000-0414-20070615
FortiGate-5005-DIST security system chassis The FortiGate-5005-DIST Security System
FortiGate-5005-DIST security system chassis
FortiGate-5005-DIST security systems can be installed in FortiGate-5050
or FortiGate-5140 chassis.
FortiGate-5140 chassis
You can install one or two I/O modules in slot 1 and 2 of the FortiGate-5140 ATCA
chassis. You can also install up to 12 worker modules in slots 3 to 14 if two I/O
modules are used, or up to 13 worker modules in slots 2 to 14 if one I/O module is
used. The FortiGate-5140 is a 12U chassis that contains two redundant hot
swappable DC power entry modules that connect to -48 VDC Data Center DC
power. The FortiGate-5140 chassis also includes three hot swappable cooling fan
trays. For details about the FortiGate-5140 chassis see to the FortiGate-5140
Chassis Guide.
Figure 4: FortiGate-5005-DIST components installed in a FortiGate-5140 chassis
FAN TRAY FAN TRAYFAN TRAY
1311975312468101214
5140
CRITICAL
RESET
MAJOR
MINOR
USER1
USER2
USER3
5140SAP
SERIAL1 SERIAL 2 ALARM
FILTER
12
012
10/100
link/Act
ETH0
Service
RESET
STATUS
Hot Swap
link/Act
ETH0 ETH1
10/100
5000SM
10/100
link/Act
ETH0
Service
RESET
STATUS
Hot Swap
link/Act
ETH0 ETH1
10/100
5000SM
PAYLOADOPERATION
STATUS IPM
X 1
X 2
1/2 3/4 D15/D16 C15/C16
1
2 3 4
5
6 7 8
9
10 11 12
D
13
14 15 16
D
1
2 3 4
5
6 7 8
9
10 11 12
C
13
14 15 16
C
10/100/1000 MBPS ETHERNET ACTIVITY
DATA CONTROL 1
2 3 4
MANAGEMENT COM 1 COM 2
X 1 X 2
PAYLOADOPERATION
STATUS IPM
X 1
X 2
1/2 3/4 D15/D16 C15/C16
1
2 3 4
5
6 7 8
9
10 11 12
D
13
14 15 16
D
1
2 3 4
5
6 7 8
9
10 11 12
C
13
14 15 16
C
10/100/1000 MBPS ETHERNET ACTIVITY
DATA CONTROL 1
2 3 4
MANAGEMENT COM 1 COM 2
X 1 X 2
CONSOLE
ACT ACT
LINK LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT ACT
LINK LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT ACT
LINK LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT ACT
LINK LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT ACT
LINK LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT ACT
LINK LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM

The FortiGate-5005-DIST Security System FortiGate-5005-DIST interface names
FortiGate-5005-DIST Security System Getting Started
01-30000-0414-20070615 9
FortiGate-5050 chassis
You can install one or two I/O modules in slot 1 and 2 of the FortiGate-5050 ATCA
chassis. You can also install up to three worker modules in slots 3 to 5 if two I/O
modules are being used, or four worker modules in slots 2 to 5 if one I/O module
is used. The FortiGate-5050 is a 5U chassis that contains two redundant DC
power connections that connect to -48 VDC Data Center DC power. The
FortiGate-5050 chassis also includes a hot swappable cooling fan tray. For details
about the FortiGate-5050 chassis, see the FortiGate-5050 Chassis Guide.
Figure 5: FortiGate-5005-DIST components installed in a FortiGate-5050 chassis
FortiGate-5005-DIST interface names
The FortiGate-5005-DIST worker web-based manager and CLI use an internal
naming convention to name FortiGate-5005-DIST interfaces. The interface names
indicate the I/O module containing the interface and also include the I/O module
front panel interface name. The naming convention is:
port<I/O_module_number>_<I/O_module_interface_name>
where:
<I/O_module_number> is 1 for the interfaces of the primary I/O module
installed in chassis slot 1 and 2 for the interfaces of the secondary I/O module
installed in chassis slot 2. The interfaces for the secondary I/O module only
appear in the web-based manager and CLI when a secondary I/O module is
installed.
<I/O_module_interface_name> is the name of the interface as shown on the
FortiController-5208 front panel.
Table 1 on page 10 shows the relationship between the names of the primary and
secondary module front panel interfaces and the interface names that appear on
the FortiGate-5005-DIST worker web-based manager and CLI.
1
2
2
3
4
5
SMC
1
SMC
POWER
5050SAP
SERIAL
1SERIAL 2
ALARM
10/100
link/Act
ETH0
Service
RESET
STATUS
Hot Swap
link/Act
ETH0 ETH1
10/100
5000SM
10/100
link/Act
ETH0
Service
RESET
STATUS
Hot Swap
link/Act
ETH0 ETH1
10/100
5000SM
PAYLOADOPERATION
STATUS IPM
X 1
X 2
1/2 3/4 D15/D16 C15/C16
1
2
3
4
5
6
7
8
9
10
11
12
D
13
14
15
16
D
1
2
3
4
5
6
7
8
9
10
11
12
C
13
14
15
16
C
10/100/1000 MBPS ETHERNET ACTIVITY
DATA CONTROL 1
2
3
4
MANAGEMENT COM 1 COM 2
X 1 X 2
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM
CONSOLE
ACT
ACT
LINK
LINK
FABRIC
BASE
USB USB
3 412 56
78
OOS ACC STATUS IPM

FortiGate-5005-DIST Security System Getting Started
10 01-30000-0414-20070615
FortiGate-5005-DIST interface names The FortiGate-5005-DIST Security System
Table 1: FortiGate-5005-DIST interface naming
FortiController-5208
location FortiController-5208 front panel interface names Web-based manager and CLI interface names
Primary
FortiController-5208
module installed in
chassis slot 1
X1 port1_X1
X2 port1_X2
1 port1_1
2 port1_2
3 port1_3
4 port1_4
Management mng
Secondary
FortiController-5208
module installed in
chassis slot 2
X1 port2_X1
X2 port2_X2
1 port2_1
2 port2_2
3 port2_3
4 port2_4
Management Not used.

Installing hardware components Getting started
FortiGate-5005-DIST Security System Getting Started
01-30000-0414-20070615 11
Installing hardware components
This section provides the information you need to install FortiGate-5005-DIST
hardware components and to make sure that they are all functioning properly.
Once you have completed the procedures in this chapter, you can configure the
FortiGate-5005-DIST system onto your network using the procedures in “Quick
Configuration Guide” on page 21.
FortiGate-5005-DIST hardware components include a FortiGate-5140 or
FortiGate-5050 chassis, one or two FortiController-5208 I/O modules, and one or
more FortiGate-5005FA2 modules. The chassis must be installed and connected
to power and the modules must be inserted into the proper chassis slots and be
operating in the correct modes before you can begin configuring your
FortiGate-5005-DIST security system.
You can install and power up the FortiGate-5005-DIST hardware components in
any order. If all of the components are installed in the correct slots, power is
connected correctly, and all components are operating in the correct mode, the
primary I/O module will connect with all components, and after a few minutes the
system will be operational.
However, the first time you install a FortiGate-5005-DIST system you should
follow the procedures in this chapter in order. The procedures in this chapter
describe a systematic process for making sure that all hardware components are
installed and functioning properly.
When all FortiGate-5005-DIST hardware components are installed and
functioning correctly, you can establish a management connection to the primary
I/O module CLI using the Com 2 console port. You can also establish a
management connection to the primary I/O module web-based manager using the
Management ethernet interface. No other management connections are possible.
You cannot connect to the FortiGate-5005FA2 console port or any interface. All
management is done through the primary I/O module.
The following topics are included in this section:
•Getting started
•Installing the chassis
•Installing FortiController-5208 modules
•Installing FortiGate-5005FA2 worker modules
Getting started
To complete the procedures in this chapter, you need:
• A FortiGate-5140 or 5050 chassis
• A rack to install the chassis in with enough space for the chassis
• DC power for the chassis
• One or two FortiController-5208 I/O modules
• SFP and XFP connectors for the interfaces you will be using

FortiGate-5005-DIST Security System Getting Started
12 01-30000-0414-20070615
Installing the chassis Installing hardware components
• One or more FortiGate-5005-DIST worker modules
• An electrostatic discharge (ESD) preventive wrist or ankle strap with
connection cord
The procedures in this chapter reference detailed hardware install information
available in the following documents. You should have these documents available
before installing your FortiGate-5005-DIST security system.
•FortiGate-5140 Chassis Guide
• FortiGate-5050 Chassis Guide
•FortiController-5208 System Guide
•FortiGate-5005FA2 Security System Guide
Installing the chassis
Begin by installing your FortiGate-5140 or FortiGate-5050 chassis using the
information in the FortiGate-5140 Chassis Guide or the FortiGate-5050 Chassis
Guide.
To install the chassis
1Install the chassis in an equipment rack.
2Connect the chassis to DC power.
3Turn on the power to the chassis.
4Verify that the chassis is operating normally.
Installing FortiController-5208 modules
If your FortiGate-5005-DIST security system includes one FortiController-5208
module it must be installed in slot 1 of your chassis. The FortiController-5208
module installed in slot 1 becomes the primary I/O module.
If your system includes two FortiController-5208 modules the second one is
installed in slot 2. Use the following steps to install each FortiController-5208
module. The FortiController-5208 module installed in slot 2 becomes the
secondary I/O module.
See the FortiController-5208 System Guide for complete information about how to
insert the FortiController-5208 module into a chassis slot.
•Installing FortiController-5208 modules
•Connecting to the FortiController-5208 CLI or web-based manager
•Configuring the primary I/O module
!Caution: FortiGate-5000 hardware components must be protected from static discharge
and physical shock. Only handle or work with FortiGate-5000 components at a static-free
workstation. Always wear a grounded electrostatic discharge (ESD) preventive wrist or
ankle strap when handling FortiGate-5000 components.

Installing hardware components Installing FortiController-5208 modules
FortiGate-5005-DIST Security System Getting Started
01-30000-0414-20070615 13
Installing FortiController-5208 modules
This procedure describes how to install one or two FortiController-5208 modules
in a FortiGate-5005-DIST chassis. This procedure also describes how to confirm
that the front panel LEDs indicate that the FortiController-5208 modules are
operating normally.
To install the FortiController-5208 modules
1Insert the FortiController-5208 module into chassis slot 1.
See the FortiController-5208 System Guide for complete details.
If the chassis is powered on, the FortiController-5208 module starts up. After a
few minutes, verify that the FortiController-5208 module normal operating LEDs
are lit.
2If your FortiGate-5005-DIST system includes a second FortiController-5208
module, install it in slot 2.
After a few minutes verify that the second FortiController-5208 module normal
operating LEDs show normal operation.
3Install SFP and XFP transceivers in the front panel interfaces of your
FortiController-5208 I/O module as required.
Connecting to the FortiController-5208 CLI or web-based manager
The following procedures describe how to confirm that a FortiController-5208
module is operating normally by connecting to the FortiController-5208 CLI or
web-based manager.
To connect to the FortiController-5208 console port
You can confirm that the FortiController-5208 module is operating normally if you
can connect to the CLI using the Com 2 front panel console port.
1Use the serial cable supplied with your FortiController-5208 module to connect
the FortiController-5208 Com 2 port to a management computer serial port.
2Start a terminal emulation program (HyperTerminal) on the management
computer.
Use these settings: Baud Rate (bps) 9600, Data bits 8, Parity None, Stop bits 1,
and Flow Control None.
3Press Enter a few times on the management computer.
If the FortiController-5208 is operating normally the login: prompt appears. You
can type admin and press Enter twice (no password required) to log into the CLI.
Table 2: FortiController-5208 normal operating LEDs
LED State
PAYLOAD OPERATION Green
STATUS Green
IPM Off

FortiGate-5005-DIST Security System Getting Started
14 01-30000-0414-20070615
Installing FortiController-5208 modules Installing hardware components
Enter the command get system status. The output similar to the following is
displayed if the FortiController-5208 is operating normally.
Version:Fortigate-5208 3.00,build039,061031
Serial-Number:123456789012345
Bios version:04000002
Hostname:FTG5K-IO
System time: Tue Nov 7 09:30:18 2006
If you cannot connect to the CLI make sure your connections are good and that
your terminal emulation settings are correct. You could also try connecting to the
web-based manager using the following procedure.
If you still cannot connect, contact Fortinet Support.
To connect to the FortiController-5208 web-based manager
You can confirm that the FortiController-5208 module is operating normally if you
can connect to the web-based manager using the Management front panel
Ethernet interface.
1Connect the Management ethernet interface of the FortiController-5208 module to
the same hub, switch, or network as a management computer.
2The default IP address of the FortiController-5208 Management interface is
192.168.1.99. Configure the management computer to be on the same subnet as
the Management interface. For example, change the IP address of the
management computer to 192.168.1.2 and the netmask to 255.255.255.0.
3To access the web-based manager, start Internet Explorer on the management
computer and browse to https://192.168.1.99 (remember to include the “s” in
https://).
If the FortiController-5208 is operating normally, the FortiGate login page appears.
4Type admin in the Name field and select Login (no password required).
The FortiController-5208 System Status page (also called the dashboard) is
displayed (for example, see Figure 6 on page 18).
If you cannot connect to the web-based manager make sure your connections are
good and that the management computer IP address is correct. The Management
interface should also respond to pings at 192.168.1.99. You could also try
connecting to the CLI using the previous procedure.
If you still cannot connect, contact Fortinet Support.
Configuring the primary I/O module
Once the FortiController-5208 modules are installed you must configure the
FortiController-5208 module installed in slot 1 to be the primary I/O module.
All FortiController-5208 modules default to operating as a secondary I/O module,
and wait for communication from the primary FortiController-5208 module.
You must always configure the FortiController-5208 module installed in slot 1 to be
the primary I/O module. This is true if the FortiGate-5005-DIST system contains
one or two FortiController-5208 modules.
If your system contains two FortiController-5208 modules an extra step is required
on the primary I/O module.

Installing hardware components Installing FortiGate-5005FA2 worker modules
FortiGate-5005-DIST Security System Getting Started
01-30000-0414-20070615 15
This section also contains an optional procedure for enabling bridge mode. Bridge
mode provides fail open protection for the FortiGate-5005-DIST system. If you
enable bridge mode, the FortiController-5208 modules will function similar to
network hubs and continue to pass traffic if all FortiGate-5005FA2 modules fail.
To configure the primary I/O module
1Connect to the CLI of the FortiController-5208 module installed in slot 1.
Use the Com 2 port as described in “To connect to the FortiController-5208
console port” on page 13.
2Enter the following commands to set the FortiController-5208 module to be the
primary I/O module.
• If there is only one FortiController-5208 module, enter the following command:
config system global
set io-primary enable
end
• If there are two FortiController-5208 modules, enter the following commands:
config system global
set io-primary enable
set io-num double
end
The FortiController-5208 module in slot 1 becomes the primary I/O module. If you
have installed a FortiController-5208 module in slot 2, the module in slot 2
recognizes that the FortiController-5208 module in slot 1 is the primary I/O
module. The FortiController-5208 module in slot 2 becomes the secondary I/O
module.
To enable bridge mode (optional)
1Connect to the CLI of the FortiController-5208 module installed in slot 1.
Use the Com 2 port as described in “To connect to the FortiController-5208
console port” on page 13.
2Enter the following command to enable bridge mode.
config system global
set io-bridge enable
end
Installing FortiGate-5005FA2 worker modules
When configured as a FortiGate-5005-DIST system, the FortiGate-5050 chassis
will support up to four FortiGate-5005FA2 modules in slots 2 to 5 with a single
FortiController-5208 module in slot 1, or up to three FortiGate-5005FA2 modules
in slots 3 to 5 with two FortiController-5208 modules in slots 1 and 2. When using
a FortiGate-5140 chassis, the FortiGate-5005-DIST system supports any
arrangement of FortiGate-5005FA2 modules in slots 3 to 14. You cannot install a
FortiGate-5005FA2 module in chassis slots 1 or 2 using the FortiGate-5140
chassis.
See the FortiGate-5005FA2 Security System Guide for complete information
about how to insert the FortiGate-5005FA2 module into a chassis slot.

FortiGate-5005-DIST Security System Getting Started
16 01-30000-0414-20070615
Installing FortiGate-5005FA2 worker modules Installing hardware components
FortiGate-5005FA2 modules can operate in normal mode or in DIST mode
depending on the firmware installed on the module. A FortiGate-5005FA2 module
must be running DIST mode firmware before it can join a FortiGate-5005-DIST
system.
The procedures in this section describe how to install FortiGate-5005FA2
modules. These procedures also describe how to determine the mode that the
FortiGate-5005FA2 module is operating in and if required how to install DIST
firmware so that the module operates in DIST mode.
•Installing FortiGate-5005FA2 modules
•Verifying that FortiGate-5005FA2 modules can communicate with the primary
I/O module
•Installing DIST firmware on a FortiGate-5005FA2 module
Installing FortiGate-5005FA2 modules
This procedure describes how to install FortiGate-5005FA2 modules in a
FortiGate-5005-DIST chassis. This procedure also describes how to confirm that
the front panel LEDs indicate that the FortiGate-5005FA2 modules are operating
normally.
To install FortiGate-5005FA2 modules
1Install a FortiGate-5005FA2 module in any slot numbered 2 or higher in a single
I/O module FortiGate-5005-DIST system, or slot 3 or higher in a dual I/O module
FortiGate-5005-DIST system.
See the FortiGate-5005FA2 Security System Guide for details.
If the chassis is powered on, the FortiGate-5005FA2 module starts up. After a few
minutes, verify that the FortiGate-5005FA2 module normal operating LEDs are lit.
2Repeat this procedure for each FortiGate-5005FA2 module to be installed.
Table 3: FortiGate-5005FA2 normal operating LEDs
LED State
OOS Off
ACC Off (Or flashing green when the system accesses the
FortiGate-5005FA2 flash disk.)
STATUS Green
IPM Off

Installing hardware components Installing FortiGate-5005FA2 worker modules
FortiGate-5005-DIST Security System Getting Started
01-30000-0414-20070615 17
Verifying that FortiGate-5005FA2 modules can communicate with the primary
I/O module
From the primary I/O module CLI or web-based manager you can display
information about the status of the FortiGate-5005FA2 modules that are operating
in DIST mode. If the FortiGate-5005FA2 modules are operating in normal mode
they are not visible from primary I/O module CLI or web-based manager. Use the
procedures in this chapter to verify that the FortiGate-5005FA2 modules that you
have installed are operating in DIST mode or not.
To view FortiGate-5005FA2 module status from the primary I/O module CLI
1Connect to the primary I/O module CLI.
See “To connect to the FortiController-5208 console port” on page 13.
2Enter the command execute worker list. If the FortiGate-5005FA2 modules
are operating in DIST mode, a message similar to the following is displayed:
2 workers are found
Found a worker at Slot-10 with IP address-192.168.100.26
Found a worker at Slot-6 with IP address-192.168.100.22
This message could be displayed by a FortiGate-5005-DIST system running in a
FortiGate-5140 chassis with worker modules installed in chassis slots 6 and 10.
The message indicates that both worker modules are operating in DIST mode and
have successfully connected to the primary I/O module and become worker
modules in the DIST configuration. The FortiGate-5005FA2 modules listed in this
message are working properly and have been successfully installed.
If some or all of the worker modules do not appear in the list, use the procedure
“To view the status of FortiGate-5005FA2 modules from the FortiGate-5005FA2
CLI” on page 18 to verify the status of each module and determine a course of
action for changing the module to operate in DIST mode.
To view worker module status from the primary I/O module web-based
manager
1Log into the primary I/O module web-based manager.
See “Connecting to the FortiController-5208 CLI or web-based manager” on
page 13.
The I/O blade system status page (also called the dashboard) is displayed (see
Figure 6).
Note: I/O and worker modules are assigned IP addresses for control communication over
the chassis backplane fabric interfaces. These IP addresses are assigned automatically
and cannot be changed. A special invisible virtual domain is used for backplane fabric
control communication. Because these IP addresses are in a separate virtual domain, they
will not conflict with the IP addresses that you assign to other FortiGate-5005-DIST
interfaces.

FortiGate-5005-DIST Security System Getting Started
18 01-30000-0414-20070615
Installing FortiGate-5005FA2 worker modules Installing hardware components
Figure 6: FortiController-5208 I/O module system status
2Check to see if the installed FortiGate-5005FA2 modules appear in the Blade
Type list on the dashboard.
Each FG5005 entry in the list indicates a FortiGate-5005FA2 module that has
successfully connected to the primary I/O module and become worker a module in
the DIST configuration. The FortiGate-5005FA2 modules in this list are working
properly and have been successfully installed.
If some or all of the worker modules do not appear in the list, use the procedure
“To view the status of FortiGate-5005FA2 modules from the FortiGate-5005FA2
CLI” on page 18 to verify the status of each module and determine a course of
action for changing the module to operate in DIST mode.
To view the status of FortiGate-5005FA2 modules from the
FortiGate-5005FA2 CLI
Use the following procedure to connect to the CLI of individual FortiGate-5005FA2
modules to verify that the module has started up and to determine the mode that
the module is operating in.
1Use the serial cable supplied with your FortiGate-5005FA2 module to connect the
FortiGate-5005FA2 Console port to a management computer serial port.
2Start a terminal emulation program (HyperTerminal) on the management
computer.
Use these settings: Baud Rate (bps) 9600, Data bits 8, Parity None, Stop bits 1,
and Flow Control None.

Installing hardware components Installing FortiGate-5005FA2 worker modules
FortiGate-5005-DIST Security System Getting Started
01-30000-0414-20070615 19
3Press Enter a few times on the management computer.
• If the message Console access disabled appears after the system starts,
the FortiGate-5005FA2 module is operating with DIST firmware installed. The
FortiGate-5005FA2 is operating in DIST mode and you should be able to view
information about the FortiGate-5005FA2 module from the primary I/O module
CLI or web-based manager. If the FortiGate-5005FA2 module does not appear
on the primary I/O module CLI or web-based manager after a few minutes,
contact Fortinet Support.
•Ifthelogin: prompt appears after the system starts, the FortiGate-5005FA2
module is operating with standard firmware. You can type admin and press
Enter twice (no password required) to log into the CLI. You must install DIST
firmware so that the FortiGate-5005FA2 module can communicate with the
primary I/O module and form a DIST system. See “Installing DIST firmware on
a FortiGate-5005FA2 module” on page 19.
• If the following message appears after the system starts and repeats every 30
seconds:
wkcfg_open_retry() failed to connect to IO blade, still
trying. Please config IO blade if it has not been
configured yet
The FortiGate-5005FA2 module is operating with DIST firmware and cannot
connect to the primary I/O module. Check to make sure the primary I/O
module is installed and configured correctly. In particular, confirm the I/O
module in slot 1 is configured as the primary. For details, see “To configure the
primary I/O module” on page 15. If this does not solve the problem, contact
Fortinet Support.
Installing DIST firmware on a FortiGate-5005FA2 module
Most new FortiGate-5005FA2 modules are shipped with normal firmware installed
in the default partition of the FortiGate-5005FA2 boot device and DIST mode
firmware installed on the boot device backup partition. If your FortiGate-5005FA2
module has DIST mode firmware installed on the boot device backup partition,
you can use the procedure below to switch the DIST mode firmware to the default
partition so that the FortiGate-5005FA2 module operates in DIST mode.
Alternatively, you can skip this procedure and just download and install the latest
FortiGate-5005FA2 DIST mode firmware using any of the firmware procedures
described in the FortiGate-5005FA2 Security System Guide.
To install DIST firmware from the backup partition
Use the following procedure to switch firmware from the boot device backup
partition to the boot device default partition. If DIST firmware is installed in the
backup partition, at the end of this procedure the FortiGate-5005FA2 module
starts up in DIST mode. If DIST firmware is not installed in the backup partition,
you can download and install the latest FortiGate-5005FA2 DIST firmware.
1Use the serial cable supplied with your FortiGate-5005FA2 module to connect the
FortiGate-5005FA2 console port to a management computer serial port.
Use these settings: Baud Rate (bps) 9600, Data bits 8, Parity None, Stop bits 1,
and Flow Control None.

FortiGate-5005-DIST Security System Getting Started
20 01-30000-0414-20070615
Installing FortiGate-5005FA2 worker modules Installing hardware components
2Press Enter a few times on the management computer.
If the FortiGate-5005FA2 module is operating normally, the login: prompt
appears. You can type admin and press Enter twice (no password required) to log
into the CLI.
3Enter the following command to restart the FortiGate-5005FA2 module.
execute reboot
The FortiGate-5005FA2 module responds with the following message:
This operation will reboot the system!
Do you want to continue? (y/n)
4Type y.
As the FortiGate-5005FA2 module starts, a series of system startup messages is
displayed. When the following messages appears:
Press any key to display configuration menu..........
......
Immediately press any key to interrupt the system startup.
.
If you successfully interrupt the startup process, the following menu appears:
[G]: Get firmware image from TFTP server.
[F]: Format boot device.
[B]: Boot with backup firmware and set as default.
[I]: Configuration and information.
[Q]: Quit menu and continue to boot with default firmware.
[H]: Display this list of options.
Enter G,F,B,I,Q,or H:
5Enter B.
The FortiGate-5005FA2 module exchanges the backup and default firmware and
then restarts. If the DIST firmware was installed in the backup partition, the
FortiGate-5005FA2 module starts up running the DIST firmware.
• If the message Console access disabled appears the
FortiGate-5005FA2 is operating in DIST mode and has successfully connected
to the primary I/O module.
• If the a message similar to the following appears:
wkcfg_open_retry() failed to connect to IO blade, still
trying. Please config IO blade if it has not been
configured yet
The FortiGate-5005FA2 module is operating with DIST firmware and cannot
connect to the primary I/O module. Check to make sure the primary I/O module
is installed and configured correctly. If this does not solve the problem, contact
Fortinet Support.
•Ifthelogin: prompt appears, the FortiGate-5005FA2 module is still running
in normal mode and you need to use any of the firmware procedures described
in the FortiGate-5005FA2 Security System Guide to install DIST firmware on
the FortiGate-5005FA2 module.
Note: You have only 3 seconds to press any key. If you do not press a key soon enough,
the FortiGate unit reboots and you must log in and repeat the execute reboot
command.