How to Perform an Initial FortiGate Configuration (FortiOS 8.0)

Setting up a FortiGate firewall from scratch can seem daunting, but following a structured initial configuration ensures both seamless end-to-end network connectivity and baseline administrative security.

Whether you are deploying a virtual appliance (VMware) or a physical FortiGate unit, this step-by-step guide walks you through initial access, network routing, firewall policies, NAT, and essential hardening settings.

Initial Access and First Login

#

Depending if you’re using a hardware or virtual appliance, the initial access to the FortiGate differs:

• Hardware appliances:
  • Entry-Level Models (e.g., FortiGate 50G, 60F, 70G, 80F, 90G): connect your PC to FortiGate port1.
  • Enterprise Models (3-digit series or higher): connect your computer directly to the dedicated management (MGMT) port.

FortiGate 90G - port1:

FortiGate 200G - MGMT port:

The default management IP address for physical appliances is 192.168.1.99/24. Set your computer’s IP within this subnet.

• Virtual Machines appliances: port1 defaults to DHCP client mode.

For FortiGate VM appliances, connect to its VM console and at the first login as admin you must set a new password:

Next, to find its assigned IP execute the following command once you are log into the VM console:

# show system interface ?

Accessing the Web GUI

#

1. Now that you know the FortiGate IP address, open a web browser and navigate to:

https://<FortiGate-IP>

In FortiGate hardware appliances the default URL would be https://192.168.1.99

2. Accept the browser security warning regarding the self-signed certificate

3. Log in with admin and your newly created password, or define a new password if this is the first time you’re log in to FortiGate:

4. Skip the initial setup wizard if you are configuring a fresh appliance from scratch.

Topology

#

We will use the following topology to exemplify the LAN and WAN configuration of the following sections:

• FortiGate port1 interface is connected to the WAN router subnet, providing internet connectivity.
• FortiGate port2 interface is connected to the LAN subnet, where a client VM is also connected.

The goal will be to allow the client VM internet traffic to be routed and permitted through FortiGate.

Configuring the WAN Interface and Default Route

#

Follow these steps to configure the WAN interface:

1. Navigate to Network > Interfaces and edit port1.
2. Set an alias (e.g., WAN) for easy identification.
3. Change addressing mode to Manual and define the static IP address and subnet mask according to the topology.
4. Leave at least HTTPS, and SSH administrative access enabled for now.
5. Press OK to save changes.

Follow these steps to configure the default static route:

1. Go to Network > Static Routes, click on Create New.
2. Configure the default route:
   • Destination: 0.0.0.0/0.0.0.0
   • Gateway Address: 192.168.26.2
   • Interface: WAN (port1)
3. Press OK to save changes.

On the top right corner, you can open a new CLI Console session to test internet connectivity from the firewall:

Use the following command for testing internet connectivity from FortiGate:

# execute ping 8.8.8.8

If everything went well we should see ping responses:

Setting Up the LAN Interface & DHCP Server

#

Follow these steps to configure the LAN interface:

1. Navigate to Network > Interfaces and edit port2.
2. Set an alias (e.g., LAN) for easy identification.
3. Define the static IP address and subnet mask according to the topology.
4. Enable PING administrative access in case we want to test connectivity later.

5. Also enable DHCP Server to lease IP addresses and default route to clients on the LAN networks. Set the Address range and Netmask matching to the LAN network in the topology:

6. Press OK to save changes.

Creating a Firewall Policy

#

FortiGate blocks all traffic by default. You must create an explicit firewall policy to allow internal LAN users to browse the web:

1. Navigate to Policy & Objects > Firewall Policy and click Create New.
2. Set the firewall policy matching fields:
   • Name: LAN to WAN
   • Incoming Interface: LAN (port2)
   • Outgoing Interface: WAN (port1)
   • Source: Create a subnet address object matching your local network (e.g., 192.168.12.0/24)
   • Destination: all
   • Service: ALL
   • Action: ACCEPT
   • NAT: Enable Source NAT (SNAT) so internal private addresses translate to the public WAN IP
   • Log Allowed Traffic: Set to All Sessions

The LAN subnet address object is defined as follows:

Finally, press OK to see your new policy listed:

Clients connected to LAN network should now be able to reach internet through FortiGate after successfully receiving a DHCP lease from FortiGate.

Recommended System Settings

#

Besides network connectivity settings, some initial system and administration settings are also recommended.

1. Go to System > Settings
   • Define a meaningful Hostname for this FortiGate device
   • Under General tab, set the Time zone according to your region.

• Under Access tab, enable Redirect to HTTPS, so unsecure HTTP administrative connections are redirected to HTTPS encrypted sessions. Also you can increase the Idle timeout for admin sessions.

2. Click Apply to save changes.

3. Under System > Administrators, you can create a new FortiGate administrator so the default admin can be deleted according to best practices.

Define the username, password and super_admin profile.

4. Click OK to save changes.

5. Log out, sign back in using the new account, and delete the default admin account to eliminate brute-force targeting.