Fortinet FortiGate Voice Series User manual

FortiGate®
Version 4.0
Desktop Install Guide

FortiGate Desktop Install Guide
Version 4.0
01 May 2009
01-400-95522-20090501
© Copyright 2009 Fortinet, Inc. All rights reserved. No part of this publication including text, examples,
diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means,
electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of
Fortinet, Inc.
Trademarks
Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient,
FortiGate®, FortiGate Unified Threat Management System, FortiGuard®, FortiGuard-Antispam,
FortiGuard-Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer, FortiManager,
Fortinet®, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield, FortiVoIP, and
FortiWiFi are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual
companies and products mentioned herein may be the trademarks of their respective owners.
Regulatory compliance
FCC Class A/Class B Part 15 CSA/CUS
CAUTION: Risk of Explosion if Battery is replaced by an Incorrect Type. Dispose of Used Batteries According
to the Instructions

Contents
FortiGate Version 4.0 Desktop Install Guide
01-400-95522-20090501 1
http://docs.fortinet.com/ • Feedback
Contents
Introduction .............................................................................................. 3
Registering your Fortinet product................................................................................. 3
Customer service and technical support...................................................................... 3
Fortinet documentation ................................................................................................. 4
Fortinet Tools and Documentation CD ....................................................................... 4
Fortinet Knowledge Center ........................................................................................ 4
Comments on Fortinet technical documentation ....................................................... 4
Conventions .................................................................................................................... 4
IP addresses............................................................................................................... 4
CLI constraints............................................................................................................ 4
Notes, Tips and Cautions ........................................................................................... 4
Typographical conventions ......................................................................................... 5
Installing ................................................................................................... 7
Environmental specifications ........................................................................................ 7
Cautions and warnings................................................................................................... 8
Grounding ................................................................................................................... 8
Rack mount instructions ............................................................................................. 8
Mounting ..................................................................................................................... 8
Plugging in the FortiGate unit........................................................................................ 9
Connecting to the network .......................................................................................... 9
Turning off the FortiGate unit ........................................................................................ 9
Configuring............................................................................................. 11
NAT vs. transparent mode ........................................................................................... 11
NAT mode................................................................................................................. 11
Transparent mode .................................................................................................... 12
Connecting to the FortiGate unit ................................................................................. 12
Connecting to the web-based manager.................................................................... 12
Connecting to the CLI ............................................................................................... 13
Configuring NAT mode................................................................................................. 13
Configure the interfaces............................................................................................ 14
Configure a DNS server............................................................................................ 16
Add a default route and gateway .............................................................................. 17
Add firewall policies .................................................................................................. 18
Configuring transparent mode .................................................................................... 20
Switching to transparent mode ................................................................................. 20
Configure a DNS server ..................................................................................... 21

Contents
FortiGate Version 4.0 Desktop Install Guide
201-400-95522-20090501
http://docs.fortinet.com/ • Feedback
Add firewall policies............................................................................................ 21
Verifying the configuration .......................................................................................... 23
Backing up the configuration ...................................................................................... 23
Restoring a configuration ............................................................................................ 24
Additional configuration............................................................................................... 25
Setting the time and date.......................................................................................... 25
Set the Administrator password................................................................................ 26
Configuring FortiGuard ............................................................................................. 27
Updating antivirus and IPS signatures ............................................................... 27
Advanced configuration ........................................................................ 29
Protection profiles ........................................................................................................ 29
Firewall policies ............................................................................................................ 30
Configuring firewall policies ...................................................................................... 31
Antivirus options........................................................................................................... 31
AntiSpam options ......................................................................................................... 32
Web filtering .................................................................................................................. 33
Data leak prevention ..................................................................................................... 34
Application control ....................................................................................................... 34
Logging .......................................................................................................................... 34
FortiGate Firmware ................................................................................ 35
Downloading firmware.................................................................................................. 35
Using the web-based manager .................................................................................... 36
Upgrading the firmware ............................................................................................ 36
Reverting to a previous version ................................................................................ 36
Backup and Restore from a USB key ....................................................................... 37
Using the USB Auto-Install ....................................................................................... 37
Using the CLI ................................................................................................................. 38
Reverting to a previous version ................................................................................ 38
Installing firmware from a system reboot using the CLI ........................................... 40
Restoring the previous configuration ........................................................................ 41
Backup and Restore from a USB key ....................................................................... 42
Using the USB Auto-Install ....................................................................................... 42
Additional CLI Commands for a USB key................................................................. 43
Testing new firmware before installing....................................................................... 43
Index.......................................................................................................... 1

Introduction Registering your Fortinet product
FortiGate Version 4.0 Desktop Install Guide
01-400-95522-20090501 3
http://docs.fortinet.com/ • Feedback
Introduction
Welcome and thank you for selecting Fortinet products for your network protection.
FortiGate®ASIC-accelerated multi-threat security systems improve network security,
reduce network misuse and abuse, and help you use communications resources more
efficiently without compromising the performance of your network. FortiGate Systems are
ICSA-certified for Antivirus, Firewall, IPSec, SSL-TLS, IPS, Intrusion detection, and
AntiSpyware services.
FortiGate Systems are dedicated, easily managed security devices that deliver a full suite
of capabilities including:
• Application-level services such as virus protection, intrusion protection, spam filtering,
web content filtering, IM, P2P, and VoIP filtering
• Network-level services such as firewall, intrusion detection, IPSec and SSL VPN, and
traffic shaping
• Management services such as user authentication, logging, reporting with
FortiAnalyzer, administration profiles, secure web and CLI administrative access, and
SNMP.
The FortiGate security system uses Fortinet’s Dynamic Threat Prevention System
(DTPS™) technology, which leverages breakthroughs in chip design, networking, security
and content analysis. The unique ASIC-accelerated architecture analyzes content and
behavior in real-time, enabling key applications to be deployed right at the network edge
where they are most effective at protecting your networks.
This chapter contains the following topics:
•Registering your Fortinet product
•Customer service and technical support
•Fortinet documentation
•Conventions
Registering your Fortinet product
Before you begin, take a moment to register your Fortinet product at the Fortinet Technical
Support web site, https://support.fortinet.com.
Many Fortinet customer services, such as firmware updates, technical support, and
FortiGuard Antivirus and other FortiGuard services, require product registration.
For more information, see the Fortinet Knowledge Center article Registration Frequently
Asked Questions.
Customer service and technical support
Fortinet Technical Support provides services designed to make sure that your Fortinet
products install quickly, configure easily, and operate reliably in your network.
To learn about the technical support services that Fortinet provides, visit the Fortinet
Technical Support web site at https://support.fortinet.com.

Fortinet documentation Introduction
FortiGate Version 4.0 Desktop Install Guide
401-400-95522-20090501
http://docs.fortinet.com/ • Feedback
You can dramatically improve the time that it takes to resolve your technical support ticket
by providing your configuration file, a network diagram, and other specific information. For
a list of required information, see the Fortinet Knowledge Center article What does
Fortinet Technical Support require in order to best assist the customer?
Fortinet documentation
The Fortinet Technical Documentation web site, http://docs.fortinet.com, provides the
most up-to-date versions of Fortinet publications, as well as additional technical
documentation such as technical notes.
In addition to the Fortinet Technical Documentation web site, you can find Fortinet
technical documentation on the Fortinet Tools and Documentation CD, and on the Fortinet
Knowledge Center.
Fortinet Tools and Documentation CD
Many Fortinet publications are available on the Fortinet Tools and Documentation CD
shipped with your Fortinet product. The documents on this CD are current at shipping
time. For current versions of Fortinet documentation, visit the Fortinet Technical
Documentation web site, http://docs.fortinet.com.
Fortinet Knowledge Center
The Fortinet Knowledge Center provides additional Fortinet technical documentation,
such as troubleshooting and how-to-articles, examples, FAQs, technical notes, a glossary,
and more. Visit the Fortinet Knowledge Center at http://kc.fortinet.com.
Comments on Fortinet technical documentation
Please send information about any errors or omissions in this or any Fortinet technical
document to [email protected].
Conventions
Fortinet technical documentation uses the conventions described below.
IP addresses
To avoid publication of public IP addresses that belong to Fortinet or any other
organization, the IP addresses used in Fortinet technical documentation are fictional and
follow the documentation guidelines specific to Fortinet. The addresses used are from the
private IP address ranges defined in RFC 1918: Address Allocation for Private Internets,
available at http://ietf.org/rfc/rfc1918.txt?number-1918.
CLI constraints
CLI constraints, such as <address_ipv4>, indicate which data types or string patterns
are acceptable input for a given parameter or variable value. CLI constraint conventions
are described in the CLI Reference document for each product.
Notes, Tips and Cautions
Fortinet technical documentation uses the following guidance and styles for notes, tips
and cautions.

Introduction Conventions
FortiGate Version 4.0 Desktop Install Guide
01-400-95522-20090501 5
http://docs.fortinet.com/ • Feedback
Typographical conventions
Fortinet documentation uses the following typographical conventions:
Tip: Highlights useful additional information, often tailored to your workplace activity.
Note: Also presents useful information, but usually focused on an alternative, optional
method, such as a shortcut, to perform a step.
Caution: Warns you about commands or procedures that could have unexpected or
undesirable results including loss of data or damage to equipment.
Table 1: Typographical conventions in Fortinet technical documentation
Convention Example
Button, menu, text box,
field, or check box label
From Minimum log level, select Notification.
CLI input config system dns
set primary <address_ipv4>
end
CLI output FGT-602803030703 # get system settings
comments : (null)
opmode : nat
Emphasis HTTP connections are not secure and can be intercepted by
a third party.
File content <HTML><HEAD><TITLE>Firewall
Authentication</TITLE></HEAD>
<BODY><H4>You must authenticate to use this
service.</H4>
Hyperlink Visit the Fortinet Technical Support web site,
https://support.fortinet.com.
Keyboard entry Type a name for the remote VPN peer or client, such as
Central_Office_1.
Navigation Go to VPN > IPSEC > Auto Key (IKE).
Publication For details, see the FortiGate Administration Guide.

Conventions Introduction
FortiGate Version 4.0 Desktop Install Guide
601-400-95522-20090501
http://docs.fortinet.com/ • Feedback

Installing Environmental specifications
FortiGate Version 4.0 Desktop Install Guide
01-400-95522-20090501 7
http://docs.fortinet.com/ • Feedback
Installing
This chapter describes installing your Fortinet unit in your server room, environmental
specifications and how to mount the Fortinet in a rack if applicable.
This chapter contains the following topics:
•Environmental specifications
•Cautions and warnings
•Plugging in the FortiGate unit
•Plugging in the FortiGate unit
•Turning off the FortiGate unit
Environmental specifications
Before you begin, review the environmental specifications to ensure proper operation of
the FortiGate unit.
• Operating temperature: 32 to 104°F (0 to 40°C)
If you install the Fortinet unit in a closed or multi-unit rack assembly, the operating
ambient temperature of the rack environment may be greater than room ambient
temperature. Therefore, make sure to install the equipment in an environment
compatible with the manufacturer's maximum rated ambient temperature.
• Storage temperature: -13 to 158°F (-25 to 70°C)
• Humidity: 5 to 90% non-condensing
• Air flow - For rack installation, make sure that the amount of air flow required for safe
operation of the equipment is not compromised.
• For free-standing installation, make sure that the appliance has at least 1.5 in. (3.75
cm) of clearance on each side to allow for adequate air flow and cooling.
This device complies with part FCC Class A or Class B, Part 15, UL/CUL, C Tick, CE
and VCCI. Operation is subject to the following two conditions:
• This device may not cause harmful interference, and
• This device must accept any interference received, including interference that may
cause undesired operation.
This equipment has been tested and found to comply with the limits for a Class B digital
device, pursuant to part 15 of the FCC Rules. These limits are designed to provide
reasonable protection against harmful interference in a residential installation. This
equipment generates, uses and can radiate radio frequency energy and, if not installed
and used in accordance with the instructions, may cause harmful interference to radio
communications. However, there is no guarantee that interference will not occur in a
particular installation. If this equipment does cause harmful interference to radio or
television reception, which can be determined by turning the equipment off and on, the
user is encouraged to try to correct the interference by one or more of the following
measures:
• Reorient or relocate the receiving antenna.
• Increase the separation between the equipment and receiver.
• Connect the equipment into an outlet on a circuit different from that to which the
receiver is connected.

Cautions and warnings Installing
FortiGate Version 4.0 Desktop Install Guide
801-400-95522-20090501
http://docs.fortinet.com/ • Feedback
• Consult the dealer or an experienced radio/TV technician for help.
The equipment compliance with FCC radiation exposure limit set forth for uncontrolled
Environment.
Cautions and warnings
Review the following cautions before installing your Fortinet unit.
Grounding
• Ensure the Fortinet unit is connected and properly grounded to a lightning and surge
protector. WAN or LAN connections that enter the premises from outside the building
should be connected to an Ethernet CAT5 (10/100 Mb/s) surge protector.
• Shielded Twisted Pair (STP) Ethernet cables should be used whenever possible rather
than Unshielded Twisted Pair (UTP).
• Do not connect or disconnect cables during lightning activity to avoid damage to the
Fortinet unit or personal injury.
Rack mount instructions
Elevated operating ambient - If installed in a closed or multi-unit rack assembly, the
operating ambient temperature of the rack environment may be greater than room
ambient. Therefore, consideration should be given to installing the equipment in an
environment compatible with the maximum ambient temperature (Tma) specified by the
manufacturer.
Reduced air flow - Installation of the equipment in a rack should be such that the amount
of air flow required for safe operation of the equipment is not compromised.
Mechanical loading - Mounting of the equipment in the rack should be such that a
hazardous condition is not achieved due to uneven mechanical loading.
Circuit overloading - Consideration should be given to the connection of the equipment
to the supply circuit and the effect that overloading of the circuits might have on
overcurrent protection and supply wiring. Appropriate consideration of equipment
nameplate ratings should be used when addressing this concern.
Reliable earthing - Reliable earthing of rack-mounted equipment should be maintained.
Particular attention should be given to supply connections other than direct connections to
the branch circuit (e.g. use of power strips).
Mounting
If required to fit into a rack unit, remove the rubber feet from the bottom of the Fortinet unit.
Place the FortiGate unit on any flat, stable surface. Ensure the unit has sufficient
clearance on each side to ensure adequate airflow for cooling.
Caution: Risk of Explosion if battery is replaced by an incorrect type. Dispose of used
batteries according to the instructions
Caution: To reduce the risk of fire, use only No. 26 AWG or larger UL Listed or CSA
Certified Telecommunication Line Cord.

Installing Plugging in the Fortinet unit
FortiGate Version 4.0 Desktop Install Guide
01-400-95522-20090501 9
http://docs.fortinet.com/ • Feedback
Plugging in the Fortinet unit
Use the following steps to connect the power supply to the FortiGate unit.
To power on the FortiGate unit
1Connect the AC adapter to the power connection at the back of the FortiGate unit.
2Connect the AC adapter to the power cable.
3Connect the power cable to a power outlet.
The FortiGate unit starts and the Power and Status LEDs light up. The Status LEDs
flash while the FortiGate unit starts up, and remain lit when the system is running.
Connecting to the network
Using the supplied Ethernet cable, connect one end of the cable to your router or modem,
whatever the connection is to the Internet. Connect the other end to the Fortinet unit.
Connect to either the External, WAN port, or port 1. Connect additional cable to the
Internal port or port 2 and your internal hub or switch.
Turning off the Fortinet unit
Always shut down the Fortinet operating system properly before turning off the power
switch to avoid potential hardware problems.
To power off the Fortinet unit
1From the web-based manager, go to System > Status.
2In the Unit Operation display, select Shutdown, or from the CLI enter:
execute shutdown
3Disconnect the power cables from the power supply.

Turning off the Fortinet unit Installing
FortiGate Version 4.0 Desktop Install Guide
10 01-400-95522-20090501
http://docs.fortinet.com/ • Feedback

Configuring NAT vs. transparent mode
FortiGate Version 4.0 Desktop Install Guide
01-400-95522-20090501 11
http://docs.fortinet.com/ • Feedback
Configuring
This section provides an overview of the operating modes of the Fortinet unit, NAT/Route
and transparent, and how to configure the unit for each mode. There are two ways you
can configure the unit, through either the web-based manager or the command line
interface (CLI). This section will step through both methods. Use whichever you are most
comfortable with.
This section includes the following topics:
•NAT vs. transparent mode
•Connecting to the FortiGate unit
•Verifying the configuration
•Backing up the configuration
•Restoring a configuration
•Additional configuration
NAT vs. transparent mode
The Fortinet unit can run in two different modes, depending on your network infrastructure
and requirements. You can choose between NAT/Route mode and transparent mode.
Both include the same robust network security features such as antispam, antivirus, VPN
and firewall policies.
NAT mode
In NAT/Route mode, the Fortinet unit is visible to the network. Like a router, all its
interfaces are on different subnets.
In NAT mode, each port is on a different subnet, enabling you to have a single IP address
available to the public Internet. The Fortinet unit performs network address translation
before sending the packet to the destination network or receiving a packet from the
destination network.
In Route mode, there is no address translation.
Figure 1: Fortinet unit in NAT mode
You typically use NAT/Route mode when the Fortinet unit is operating as a gateway
between private and public networks. In this configuration, you would create NAT mode
firewall policies to control traffic flowing between the internal, private network and the
external, public network, usually the Internet.
In this guide, unless otherwise stated, references to NAT mode apply to both NAT and
Route mode.
Internet
Router
External
Transparent mode policies controlling
traffic between internal and external networks
Internal
10.10.10.2 192.168.1.99
Hub or Switch
Internal Network
192.168.1.X

Connecting to the Fortinet unit Configuring
FortiGate Version 4.0 Desktop Install Guide
12 01-400-95522-20090501
http://docs.fortinet.com/ • Feedback
Transparent mode
In transparent mode, the Fortinet unit is invisible to the network. Similar to a network
bridge, all FortiGate interfaces must be on the same subnet. You only have to configure a
management IP address to make configuration changes. The management IP address is
also used for antivirus and attack definition updates.
Figure 2: Fortinet unit in transparent mode
You typically use the Fortinet unit in transparent mode on a private network behind an
existing firewall or behind a router. The Fortinet unit performs firewall functions, IPSec
VPN, virus scanning, IPS web filtering, and Spam filtering.
Connecting to the Fortinet unit
To configure, maintain and administer the Fortinet unit, you need to connect to it. There
are two methods for these tasks:
• using the web-based manager: a GUI interface that you connect to using a current web
browser such as FireFox or Internet Explorer.
• using the command line interface (CLI): a command line interface similar to DOS or
UNIX commands that you connect to using an SSH terminal or Telnet terminal.
Connecting to the web-based manager
To connect to the web-based manager, you require:
• a computer with an Ethernet connection
• Microsoft Internet Explorer version 6.0 or higher or any recent version of a common
web browser
• an Ethernet cable.
To connect to the web-based manager
1Set the IP address of the management computer to the static IP address
192.168.1.2 with a netmask of 255.255.255.0.
2Using the Ethernet cable, connect the internal interface of the Fortinet unit to the
computer Ethernet connection.
3Start your browser and enter the address https://192.168.1.99. (remember to
include the “s” in https://).
To support a secure HTTPS authentication method, the Fortinet unit ships with a
self-signed security certificate, which is offered to remote clients whenever they initiate
a HTTPS connection to the Fortinet unit. When you connect, the Fortinet unit displays
two security warnings in a browser.
Internet
Router
External
Management IP
10.10.10.1
Transparent mode policies controlling
traffic between internal and external networks
Internal
Gateway to public network
192.168.1.1 10.10.10.2
Hub or Switch
Internal Network
10.10.10.X

Configuring Configuring NAT mode
FortiGate Version 4.0 Desktop Install Guide
01-400-95522-20090501 13
http://docs.fortinet.com/ • Feedback
The first warning prompts you to accept and optionally install the Fortinet unit’s self-
signed security certificate. If you do not accept the certificate, the Fortinet unit refuses
the connection. If you accept the certificate, the FortiGate login page appears. The
credentials entered are encrypted before they are sent to the Fortinet unit. If you
choose to accept the certificate permanently, the warning is not displayed again.
Just before the FortiGate login page is displayed, a second warning informs you that
the FortiGate certificate distinguished name differs from the original request. This
warning occurs because the Fortinet unit redirects the connection. This is an
informational message. Select OK to continue logging in.
4Type admin in the Name field and select Login.
Connecting to the CLI
To connect to the FortiGate CLI you require:
• a computer with an available communications port
• a serial cable, either an RJ-45 to DB-9 or null modem cable, whichever was included in
your FortiGate package
• terminal emulation software such as HyperTerminal for Microsoft Windows.
To connect to the CLI
1Connect the serial cable to the communications port of your computer and to the
FortiGate console port.
2Start HyperTerminal, enter a name for the connection and select OK.
3Configure HyperTerminal to connect directly to the communications port on your
computer and select OK.
4Select the following port settings and then select OK:
5Press Enter to connect to the FortiGate CLI.
6When the login prompt appears, type admin and press Enter twice.
Type ?to list available commands. For information about how to use the CLI, see the
FortiGate CLI Reference.
Configuring NAT mode
When configuring NAT mode, you need to define interface addresses and default routes,
and simple firewall policies. You can use the web-based manager or the CLI to configure
the Fortinet unit in NAT/Route mode.
Note: The following procedure uses Microsoft Windows HypterTerminal software. You can
apply these steps to any terminal emulation program.
Bits per second 9600
Data bits 8
Parity None
Stop bits 1
Flow control None

Configuring NAT mode Configuring
FortiGate Version 4.0 Desktop Install Guide
14 01-400-95522-20090501
http://docs.fortinet.com/ • Feedback
Configure the interfaces
When shipped, the Fortinet unit has a default address of 192.168.1.99 and a netmask of
255.255.255.0. for either the Port 1 or Internal interface. You need to configure this and
other ports for use on your network.
To configure interface for manual addressing - web-based manager
1Go to System > Network > Interface.
2Select the Edit icon for an interface.
3Enter the IP address and netmask for the interface.
To configure an interface for manual addressing - CLI
config system interface
edit <interface_name>
set mode static
set ip <interface_ipv4mask>
end
To configure DHCP addressing - web-based manager
1Go to System > Network > Interface.
2Select the Edit icon for an interface.
3Select DHCP and complete the following:
4Select OK.
Note: If you change the IP address of the interface you are connecting to, you must
connect through a web browser again using the new address. Browse to https:// followed by
the new IP address of the interface. If the new IP address of the interface is on a different
subnet, you may have to change the IP address of your computer to the same subnet.
Distance Enter the administrative distance, between 1 and 255 for the default
gateway retrieved from the DHCP server. The administrative distance
specifies the relative priority of a route when there are multiple routes to
the same destination. A lower administrative distance indicates a more
preferred route.
Retrieve default gateway
from server
Enable to retrieve a default gateway IP address from the DHCP server.
The default gateway is added to the static routing table.
Override internal DNS Enable to use the DNS addresses retrieved from the DHCP server
instead of the DNS server IP addresses on the DNS page on System >
Network > Options. You should also enable Obtain DNS server address
automatically in System > Network > Options.

Configuring Configuring NAT mode
FortiGate Version 4.0 Desktop Install Guide
01-400-95522-20090501 15
http://docs.fortinet.com/ • Feedback
Figure 3: Configuring DHCP addressing
To configure DHCP addressing - CLI
config system interface
edit external
set mode dhcp
set distance <integer>
set defaultgw enable
end
To configure DHCP addressing - web-based manager
1Go to System > Network > Interface.
2Select the Edit icon for an interface.
3Select PPPoE, and complete the following:
4Select OK.
Username Enter the username for the PPPoE server. This may have been
provided by your Internet Service Provider.
Password Enter the password for the PPPoE server for the above user name.
Unnumbered IP Specify the IP address for the interface. If your Internet Service Provider
has assigned you a block of IP addresses, use one of these IP
addresses. Alternatively, you can use, or borrow, the IP address of a
configured interface on the router. You may need to do this to minimize
the number of unique IP addresses within your network.
If you are borrowing an IP address, remember the interface must be
enabled, and Ethernet connected.
Initial Disc Timeout Initial discovery timeout in seconds. The amount of time to wait before
starting to retry a PPPoE discovery. To disable the discovery timeout,
set the value to 0.
Initial PADT Timeout Initial PPPoE Active Discovery Terminate (PADT) timeout in seconds.
Use this timeout to shut down the PPPoE session if it is idle for this
number of seconds. Your Internet Service Provider must support PADT.
To disable the PADT timeout, set the value to 0.
Distance Enter the administrative distance, between 1 and 255, for the default
gateway retrieved from the DHCP server. The administrative distance
specifies the relative priority of a route when there are multiple routes to
the same destination. A lower administrative distance indicates a more
preferred route.
Retrieve default gateway
from server
Enable to retrieve a default gateway IP address from the DHCP server.
The default gateway is added to the static routing table.
Override internal DNS Enable to use the DNS addresses retrieved from the DHCP server
instead of the DNS server IP addresses on the DNS page on System >
Network > Options. On Fortinet-100 units and lower, you should also
enable Obtain DNS server address automatically in System > Network >
Options.

Configuring NAT mode Configuring
FortiGate Version 4.0 Desktop Install Guide
16 01-400-95522-20090501
http://docs.fortinet.com/ • Feedback
Figure 4: Configuring PPPoE addressing
To configure PPPoE addressing - CLI
config system interface
edit external
set mode pppoe
set username <pppoe_username>
set password <pppoe_password>
set ipunnumbered <unnumbered_ipv4>
set disc-retry-timeout <pppoe_retry>
set padt-retry-timeout <pppoe_retry>
set distance <integer>
set defaultgw enable
end
Configure a DNS server
A DNS server is a service that converts symbolic node names to IP addresses. A domain
name server (DNS server) implements the protocol. In simple terms, it acts as a phone
book for the Internet. A DNS server matches domain names with the computer IP
address. This enables you to use readable locations, such as fortinet.com when browsing
the Internet.
DNS server IP addresses are typically provided by your Internet Service Provider.
To configure DNS server settings - web-based manager
1Go to System > Network > Options.
2Enter the IP address of the primary DNS server.
3Enter the IP address of the secondary DNS server.
4Select Apply.

Configuring Configuring NAT mode
FortiGate Version 4.0 Desktop Install Guide
01-400-95522-20090501 17
http://docs.fortinet.com/ • Feedback
Figure 5: Configure a DNS server
To configure DNS server settings - CLI
config system dns
set primary <dns_ipv4>
set secondary <dns_ipv4>
end
Add a default route and gateway
A route provides the Fortinet unit with the information it needs to forward a packet to a
particular destination. A static route causes packets to be forwarded to a destination other
than the default gateway. You define static routes manually. Static routes control traffic
exiting the Fortinet unit. You can specify through which interface the packet will leave and
to which device the packet should be routed.
In the factory default configuration, entry number 1 in the Static Route list is associated
with a destination address of 0.0.0.0/0.0.0.0, which means any/all destinations. This route
is called the “static default route”. If no other routes are present in the routing table and a
packet needs to be forwarded beyond the Fortinet unit, the factory configured static
default route causes the Fortinet unit to forward the packet to the default gateway.
For an initial configuration, you must edit the factory configured static default route to
specify a different default gateway for the Fortinet unit. This will enable the flow of data
through the unit.
For details on adding additional static routes, see the FortiGate Administration Guide.
To modify the default gateway - web-based manager
1Go to Router > Static.
2Select the Edit icon for the default route
3In the Gateway field, type the IP address of the next-hop router where outbound traffic
is directed.
4If the Fortinet unit reaches the next-hop router through a different interface (compared
to the interface that is currently selected in the Device field), select the name of the
interface from the Device field.
5Select OK.

Configuring NAT mode Configuring
FortiGate Version 4.0 Desktop Install Guide
18 01-400-95522-20090501
http://docs.fortinet.com/ • Feedback
Figure 6: Configure the default gateway
To modify the default gateway - CLI
config router static
edit <sequence_num>
set gateway <gateway_address_ipv4>
set device <interface_name>
end
Add firewall policies
Firewall policies enable traffic to flow through the Fortinet interfaces. Firewall policies
define how the Fortinet unit processes the packets in a communication session. You can
configure the firewall policies to allow only specific traffic, users and specific times when
traffic is allowed.
For the initial installation, a single firewall policy that enables all traffic to flow through will
enable you to verify your configuration is working. On lower-end units such a default
firewall policy is already in place. For the high-end Fortinet units, you need to add a
firewall policy.
The following steps add two policies that allows all traffic through the Fortinet unit, to
enable you to continue testing the configuration on the network.
To add an outgoing traffic firewall policy - web-based manager
1Go to Firewall > Policy.
2Select Create New.
3Set the following and select OK.
Source Interface/Zone Select the port connected to the network.
Source Address All
Destination Interface/Zone Select the port connected to the Internet.
Destination Address All
Schedule always
Service Any
Action Accept