In this configuration, a FortiGate is installed as a gateway or router between a private network and the Internet. By using network address translation (NAT), the FortiGate is able to hide the IP addresses of the private network.

Installing a FortiGate in NAT/Route Mode

1. Connect the FortiGate’s Internet-facing interface (typically WAN1) to your ISP-supplied equipment.
2. Connect a PC to the FortiGate using an internal port (typically port 1).
3. Power on the ISP’s equipment, the FortiGate, and the PC on the internal network.
4. From the PC on the internal network, connect to the FortiGate’s GUI using either FortiExplorer or an Internet browser (for information about connecting to the GUI, please see your models QuickStart Guide). Login using an admin account (the default admin account has the username admin and no password).
5. Go to Network > Interfaces and edit the Internet-facing interface. Set Addressing Mode to Manual and the IP/Netmask to your public IP address. Select OK.

If you have ISP equipment between your FortiGate and the Internet (for example, a router), then the wan1 IP will also use a private IP assigned by the ISP equipment. If this equipment uses DHCP, set Addressing Mode to DHCP to get an IP assigned to the interface. If the ISP equipment does not use DHCP, your ISP can provide you with the correct private IP to use for the interface.

6. Edit the lan interface (called internal on some FortiGate models). Make sure the interface's Role is set to LAN. Set Addressing Mode to Manual and set the IP/Netmask to the private IP address you wish to use for the FortiGate. Select OK.
   
   
7. Go to Network > Static Routes and select Create New to add a default route. Set Destination to Subnet (which allows you to input a numeric IP address or subnet), Destination IP/Mask to 0.0.0.0/0.0.0.0, Device to the Internet-facing interface, and Gateway to the gateway (or default route) provided by your ISP or to the next hop router, depending on your network requirements. Select OK.
   
   

A default route always has a Destination IP/Mask of 0.0.0.0/0.0.0.0. Normally, you would have only one default route. If the static route list already contains a default route, you can either edit it or delete it and add a new one.

8. (Optional) The FortiGate’s DNS Settings are set to use FortiGuard DNS servers by default, which is sufficient for most networks. However, if you need to change the DNS servers, go to Network > DNS, select Specify, and add Primary and Secondary DNS servers. Select Apply.

Some FortiGate models include an IPv4 security policy allowing access from LAN/Internal to WAN/WAN1 in the default configuration. This policy can be found at Policy & Objects > IPv4 Policy. If you have one of these models, users are now able to access the Internet.

9. Go to Policy & Objects > IPv4 Policy and select Create New to add a security policy that allows users on the private network to access the Internet.

If your network uses IPv6 addresses, go to Policy & Objects > IPv6 Policyand select Create New to add a security policy that allows users on the private network to access the Internet. If the IPv6 menu option is not available, go to System > Feature Select, turn on IPv6, and select Apply. For more information on IPv6 networks, see the IPv6 Handbook.

10. In the policy, set the Incoming Interface to lan and the Outgoing Interface to the Internet-facing interface. You will also need to set Source, Destination Address, Schedule, and Service according to your network requirements. You can set these fields to the default all/ANY settings for now but should create the appropriate objects later after the policies have been verified. Make sure the Action is set to ACCEPT. Turn on NAT and make sure Use Outgoing Interface Address is selected. Select OK.

It is recommended to avoid using any security profiles, such as AntiVirus or Web Filter, until after you have successfully installed the FortiGate. After the installation is verified, you can apply any required security profiles. For more information about using security profiles, see the Security Profiles handbook.

Results

Users on the internal network are now able to access the Internet. They should also be able to connect to the Internet using any other protocol or connection method that you defined in the security policy.

 

In this configuration, a WAN link interface is created providing the FortiGate with redundant Internet connections from two Internet service providers (ISPs). The WAN link interface combines these two connections, allowing the FortiGate to treat them as a single interface.

Installing a FortiGate with Redundant Internet

If you have previously configured your FortiGate using the standard installation, you will have to delete all routes and policies referring to an interface that will be used to provide redundant Internet. This includes the default Internet access policy that is included on many FortiGate models.

1. Connect the FortiGate’s Internet-facing interfaces (typically WAN1 and WAN2) to your ISP-supplied equipment.
2. Go to Network > WAN LLB to create a WAN link interface, which is used to group multiple Internet connections together so that the FortiGate can treat them as a single interface.

3. Select an appropriate method of WAN Load Balancing from the following options:

• Source IP based - The next hop is based on the traffic’s source IP address.
• Weighted Round Robin - Weight is input for all the active members of the WAN link.
• Spill-over - A traffic cap is defined for active members; when it is exceeded, the traffic will automatically activate the standby link.
• Source-Destination IP based - The next hop is based on both the traffic’s source and destination IP address.
• Measured-Volume based- A volume ratio is set for each active member of the WAN link.

4. Add your Internet-facing interfaces to the WAN link interface and configure load balancing as required for each interface.
5. Go to Network > Static Routes and create a new default route. Set Device to the virtual WAN link.
6. Go to Policy & Objects > IPv4 Policy and select Create New to add a security policy that allows users on the private network to access the Internet.
   

If your network uses IPv6 addresses, go to Policy & Objects > IPv6 Policy and select Create New to add a security policy that allows users on the private network to access the Internet. If the IPv6 menu option is not available, go to System > Feature Select, turn on IPv6, and select Apply. For more information on IPv6 networks, see the IPv6 Handbook.

4. In the policy, set the Incoming Interface to the internal interface and the Outgoing Interface to the WAN link interface. You will also need to set Source Address, Destination Address, Schedule, and Service according to your network requirements. You can set these fields to the default all/ANY settings for now but should create the appropriate objects later after the policies have been verified.
5. Make sure the Action is set to ACCEPT. Turn on NAT and make sure Use Destination Interface Address is selected. Select OK.

It is recommended to avoid using any security profiles, such as AntiVirus or Web Filter, until after you have successfully installed the FortiGate. After the installation is verified, you can apply any required security profiles. For more information about using security profiles, see the Security Profiles handbook.

Results

Users on the internal network are now able to browse the Internet. They should also be able to connect to the Internet using any other protocol or connection method defined in the security policy.

The amount of traffic an individual member of the WAN link interface will use will depend on the load balancing method selected. You can view this usage by going to FortiView > All Sessions and viewing the Destination Interface column. If this column is not shown, right-click on the title row and select Destination Interface from the dropdown menu. Scroll to the bottom of the menu and select Apply.