New Fortigate Setup

[PC88]

Hi All,

I'm very new to the Fortigate product and I have been testing it in a lab environment with a basic setup which is working fine.

I'm looking to moving this into the production environment which will initially need to have communications between our internal networks and external networks with the ability to later use it for external access to Sharepoint & Skype for Business internal servers. (I think this makes sense)

The current setup of the network is Cisco 3750's doing all the routing of the network, there are multiple VLANs so it isn't as simple as one network.

I was wondering if anyone had some tips / pointers of what direction to go with the Fortigate to do this? And what needs to be configured.

Many thanks for your time.

PC 

[ede_pfau]

hi,

I think you shouldn't worry too much. At this initial deployment, look at the FGT as a router. Connect a VLAN trunk from your core switch to (one of) the internal interface(s) on which you have previously created the VLAN gateways.

Routes to the VLANs will be created automatically (check with the Routing Monitor). Then (probably) this traffic will go out the WAN port via the default route.

Make sure you have at least one policy per VLAN-WAN port pair to allow outbound traffic, and enable NAT on it.

This should enable basic internet access for the VLANs envolved.

At a later stage, create one VIP (Firewall > Virtual IP) for each internal server which is to be reached from the internet, either with or without port translation. Servers like this are usually connected to a separate port on the FGT, forming a DMZ. Use the VIP in a policy ('wan1' -> 'internal' or 'dmz', source address 'all' -> VIP) to allow traffic in and to enable the VIP/address translation.

If you have more specific questions regarding your setup, feel free to post here.

[PC88]

Hi again, 

thanks for your response, I am pretty new to this sort of thing.

Currently the Fortigate is simply providing internet to a Cisco WLAN controller nothing setup for internal networks.

For example we have a 3750 at each site which has its own vlan 172.16.2.* for example is the site the Fortigate is based at another site is 172.16.1.* all routing via the 3750. How do i go about setting up the VLAN on the Fortigate as it is asking for a specific IP address.

At the moment my understanding is I have a trunk port on the 3750 which carries all the VLans plugged into on eof the physical ports on the Fortigate, configured as a LAN port but again it asks for a specific IP address not 172.16.2.*. Then how would i go about configuring the VLANs?

Forgive my newbie questions.

Any help you can offer is greatly appreciated.

Many thanks

Paul

[ede_pfau]

I'm a bit puzzled now.

VLANs are just like LANs. The switch port and the FGT port need to be in the same LAN / network range but with separate host IPs. Just think of the (virtual) VLAN port as being a LAN port.

And for the rest: [link]http://docs.fortinet.com[/link]