Planning The Fortigate Configuration; Nat/Route Mode - Fortinet FortiGate FortiGate-3000 Installation Manual

Getting started

Planning the FortiGate configuration

NAT/Route mode

FortiGate-3000 Installation Guide
Figure 4: Web protection profile settings
Before you configure the FortiGate unit, you need to plan how to integrate the unit into
the network. Among other things, you must decide whether you want the unit to be
visible to the network, which firewall functions you want it to provide, and how you
want it to control the traffic flowing between its interfaces.
Your configuration plan depends on the operating mode that you select. The FortiGate
unit can be configured in one of two modes: NAT/Route mode (the default) or
Transparent mode.
In NAT/Route mode, the FortiGate unit is visible to the network. Like a router, all its
interfaces are on different subnets. The following interfaces are available in
NAT/Route mode:
• External is the interface to the external network (usually the Internet).
• Internal is the interface to the internal network.
• Ports 1 and 3 can be connected to any networks.
• Port 2 can be connected to a DMZ network or to any other network.
• Port 4/HA can be connected to another network. Port 4/HA can also be connected
to other FortiGate-3000s if you are installing an HA cluster.
You can add firewall policies to control whether communications through the FortiGate
unit operate in NAT or Route mode. Firewall policies control the flow of traffic based
on the source address, destination address, and service of each packet. In NAT
mode, the FortiGate unit performs network address translation before it sends the
packet to the destination network. In Route mode, there is no address translation.
01-28005-0026-20041101
Planning the FortiGate configuration
21