Fortinet 50A/50B Benutzerhandbuch

In Transparent mode, the FortiGate unit is invisible to the network. Similar to a 
network bridge, all FortiGate interfaces must be on the same subnet. You only 
have to configure a management IP address so that you can make configuration 
changes. The management IP address is also used for antivirus and attack 
definition updates.

You typically use the FortiGate unit in Transparent mode on a private network 
behind an existing firewall or behind a router. The FortiGate unit performs firewall 
functions, IPSec VPN, virus scanning, IPS web content filtering, and Spam 
filtering.

The factory default configuration of your FortiGate unit allows the default public 
interface to respond to ping requests. The default public interface is also called 
the default external interface, and is the interface of the FortiGate unit that is 
usually connected to the Internet. 

For the most secure operation, you should change the configuration of the 
external interface so that it does not respond to ping requests. Not responding to 
ping requests makes it more difficult for a potential attacker to detect your 
FortiGate unit from the Internet. 

A FortiGate unit responds to ping requests if ping administrative access is 
enabled for that interface. You can use the following procedures to disable ping 
access for the external interface of a FortiGate unit. You can use the same 
procedure for any FortiGate interface. You can also use the same procedure in 
NAT/Route or Transparent mode. 

Internal network

Internal

Internet

Router

FortiGate-100

External

DMZ

Internal

DMZ network 

Web Server

Mail Server