Desparate for help

Hi T,

It sounds like your old firewall was doing NAT rather than transparent, but maybe their terminology was wrong and led you to believe otherwise.

First thing you'll want to put the FortiGate in NAT mode if you haven't already.  Then you need to configure your WAN interface with the same IP you were using before (201.86.251.34/27). 

You also need to set up a static default route (Network > Static Routes) to go out your WAN interface with a gateway address of 201.86.251.33 (your ISP's router).

At this point the firewall itself should have Internet.  You can test by going into CLI and running execute ping 8.8.8.8

Now you need to make sure your internal network configuration works.  It sounds like you've decided on 10.1.1.34 for the firewall's internal address, but I would generally recommend using the first address in a subnet for your router, as in 10.1.1.1.  Either way, you probably want it to hand out DHCP to your internal hosts, so you'll accomplish this on the interface configuration for your lan (Network > Interfaces).  If you have an internal DNS server (i.e. running Microsoft AD?), you'll want to use that under the "specify" DNS option, or you can specify 8.8.8.8 for now.

Lastly you need at least one firewall policy.  Under Policy & Objects > IPv4 Policy, you need to define one with a source interface of your lan, a destination interface of your wan, and you can use "all" for the source and destination addresses.  For now you can do ALL services as well, though I recommend allowing only needed traffic (HTTP/HTTPS for a start).  You will need to make sure the NAT option is selected, and for now you can just use the outgoing interface IP. 

Later you will want to create IP Pools and use those to NAT traffic from specific hosts to get you back to the addressing you had before.  You will also need VIP objects to go the other way (outside to inside) and use in the WAN to LAN firewall policies.

I hope this is helpful.  It does sound like you're in a little bit over your head...if you can find a local professional to assist you, that will be ideal.  :)  I would help remotely if you could pay me, but it would be hard to do until you get Internet access on the device you're using to configure the device...catch-22, ha.

- Daniel

tbv wrote:

In the old system we gave the firewall the .34 and set the gateway on each PC to be .34.  Each PC had a public IP in our range, and we used the rules/policy to restrict traffic.  This was done because the stations need to be access from outside the LAN (not just ports forwarded) and when the station reached outside the LAN they showed that public IP.

To me that says that he had to be using NAT mode previously, so I was trying to keep it as simple as possible.  I can think of lots of reasons to use NAT mode over transparent though, not least of which is scalability.  What if he has (or gets) more hosts on the inside than he has public addresses for?  Unless some other device inside is providing NAT to the extra hosts, he would have to redesign it at that time, right?  Why not just do it better out of the box?  :)

Hi,

It can be done. Set the UTM to transparent mode.