Installing a FortiGate in NAT/Route mode

1. Connecting the network devices and logging onto the FortiGate

Connect the FortiGate’s Internet-facing interface (typically WAN or WAN1, depending on your model) to your ISP-supplied equipment and connect a PC to the FortiGate using an internal port (typically port 1).

Power on the ISP’s equipment, the FortiGate unit, and the PC on the internal network.

Using a PC on the internal network, connect to the FortiGate’s GUI using either FortiExplorer or an Internet browser (for information about connecting to the GUI, see your model’s QuickStart Guide).

Login using an admin account (the default admin account has the username admin and no password).

2. Configuring the FortiGate’s interfaces

Go to Network > Interfaces and edit the Internet-facing interface (in the example, wan1).

Set Role to WAN and set your Estimated Bandwidth (make sure to use Kbps, rather than Mbps).

If your FortiGate is directly connecting to your ISP, set Addressing Mode to Manual and set the IP/Netmask to the public IP address your ISP has provided you with.

If you have ISP equipment between your FortiGate and the Internet (for example, a router), then the wan1 IP will also use a private IP assigned by the ISP equipment. If this equipment uses DHCP, set Addressing Mode to DHCP to get an IP assigned to the interface.

If the ISP equipment does not use DHCP, your ISP can provide you with the correct private IP to use for the interface.

Edit the lan interface (called internal on some FortiGate models).

Set Role to LAN.

Set Addressing Mode to Manual and set the IP/Netmask to the private IP address you wish to use for the FortiGate.

If you need your FortiGate to provide IP addresses to devices that connect to it, enable DHCP Server.

3. Adding a default route

Go to Network > Static Routes and create a new default route.

Set Destination to Subnet, Destination IP/Mask to 0.0.0.0/0.0.0.0, the Device to the Internet-facing interface, and the Gateway to the gateway (or default route) provided by your ISP or to the next hop router, depending on your network requirements.

4. (Optional) Setting the FortiGate’s DNS servers

5. Creating a policy to allow traffic from the internal network to the Internet

Go to Policy & Objects > IPv4 Policy and create a new policy. Give the policy a Name that indicates that the policy will be for traffic to the Internet (in the example, Internet).

Set the Incoming Interface to the lan interface and the Outgoing Interface to the Internet-facing interface. Set Source, Destination Address, Schedule, and Services as required.

Make sure the Action is set to ACCEPT. Turn on NAT and make sure Use Outgoing Interface Address is selected.

5. Results

Browse the Internet using the PC that connects to the FortiGate’s internal interface.

You can view information about the traffic being processed by your FortiGate by going to FortiView. Under Traffic from LAN/DMZ, select Sources. A listing is shown for the computer you are browsing with.

Right-click on the listing for your computer and select Drill Down to Details to view realtime information about traffic from this computer.

If your FortiGate model has a hard drive, a dropdown menu in the top corner will allow you to view historical logging information (5 minutes, 1 hour, and 24 hours).