Stackvora.tech

FortiGate Day-1 Setup: Interfaces, Policies and SD-WAN

This article outlines the essential Day-1 configuration steps for a new FortiGate firewall, focusing on establishing basic network connectivity, security…

This article outlines the essential Day-1 configuration steps for a new FortiGate firewall, focusing on establishing basic network connectivity, security policies, and an initial SD-WAN setup. The procedures are applicable to FortiOS versions 6.4 through 7.2 on models ranging from FortiGate 60E to 200F, with minor command variations for specific features.

The goal is to move from an factory-default state to a functional internet gateway with foundational security in place, capable of providing internet access to a local network and preparing for more advanced configurations.

1. Initial Access and Interface Configuration

Upon factory reset, FortiGate devices are typically accessible via port1 at 192.168.1.99/24. Connect a management workstation to port1, configure its IP address in the 192.168.1.0/24 range (e.g., 192.168.1.100), and access the web GUI via HTTPS (https://192.168.1.99). The default username is admin with no password.

1.1. WAN Interface (port1) Configuration

The first step is to configure the WAN interface (typically port1) to connect to your ISP. This can be done via DHCP or a static IP address.

config system interface
    edit "port1"
        set mode dhcp
        set allowaccess ping https ssh http fgfm capwap fortiems
        set description "ISP_WAN"
    next
end

For a static IP configuration, use:

config system interface
    edit "port1"
        set mode static
        set ip 203.0.113.2/29  <-- Replace with your static IP and subnet mask
        set allowaccess ping https ssh http fgfm capwap fortiems
        set description "ISP_WAN"
    next
end

Note: allowaccess defines which management protocols are permitted on the interface. For WAN, HTTPS and Ping are usually sufficient. SSH can be added for CLI access. FG-Access (fgfm) is for FortiManager enrollment. CAPWAP is for FortiAP management.

1.2. LAN Interface (port2) Configuration and DHCP Server

Configure a LAN interface (e.g., port2) for your internal network and enable a DHCP server to assign IP addresses to internal clients.

config system interface
    edit "port2"
        set mode static
        set ip 192.168.1.1/24  <-- FortiGate's IP for the LAN segment
        set allowaccess ping https http fgfm
        set description "Internal_LAN"
    next
end

config system dhcp server
    edit 1
        set interface "port2"
        set dns-service default
        set default-gateway 192.168.1.1
        set start-ip 192.168.1.100
        set end-ip 192.168.1.200
        set netmask 255.255.255.0
        set lease-time 604800
    next
end

After applying these changes, move your management workstation to the LAN side (port2) and obtain an IP address via DHCP, then access the FortiGate at its new LAN IP (e.g., https://192.168.1.1).

2. Static Route to ISP Gateway

If your WAN interface (port1) was configured with a static IP, you must define a static route to your ISP's gateway. If port1 uses DHCP, the default route is typically learned automatically.

config router static
    edit 1
        set device "port1"
        set gateway 203.0.113.1  <-- Replace with your ISP's gateway IP
        set dst 0.0.0.0 0.0.0.0  <-- Default route
    next
end


Verify the routing table:


get router info routing-table all



3. Firewall Policy: LAN to WAN (Internet Access)



A firewall policy is required to allow traffic from the internal LAN network out to the internet. This policy will include Source NAT (SNAT) to translate internal private IP addresses to the FortiGate's public WAN IP.


config firewall policy
    edit 1
        set name "LAN-to-INTERNET"
        set srcintf "port2"  <-- Source interface (your LAN)
        set dstintf "port1"  <-- Destination interface (your WAN)
        set srcaddr "all"    <-- Source address (all IPs on LAN)
        set dstaddr "all"    <-- Destination address (anywhere on internet)
        set action accept
        set schedule "always"
        set service "ALL"    <-- All services (protocols/ports)
        set nat enable       <-- Enable Source NAT
        set logtraffic all   <-- Log all sessions for troubleshooting
    next
end


This policy is very broad. For better security, consider restricting srcaddr to specific internal subnets and service to only necessary protocols (e.g., HTTP, HTTPS, DNS).



4. Basic Security Profiles (UTM/NGFW)



Enhance the firewall policy with Unified Threat Management (UTM) or Next-Generation Firewall (NGFW) security profiles to provide protection against various threats. For Day-1, a basic set of profiles is recommended.


First, ensure the appropriate security profiles are enabled and configured with basic settings (usually default profiles are a good starting point for inspection):


    
    
  • AntiVirus: Scans files for known malware.
    • 
    
  • Web Filter: Blocks access to malicious or inappropriate websites based on categories.
    • 
    
  • Application Control: Identifies and controls applications regardless of port or protocol.
    • 
    
  • DNS Filter: Blocks access to malicious domains via DNS lookups.
    • 
    
  • Intrusion Prevention (IPS): Protects against known exploit techniques.
    • 



Then, modify the existing policy to apply these profiles:


config firewall policy
    edit 1 <-- Use the policy ID from the previous step
        set av-profile "default"
        set webfilter-profile "default"
        set application-list "default"
        set dnsfilter-profile "default"
        set ips-sensor "default"
        set ssl-ssh-profile "certificate-inspection" <-- Basic SSL inspection
    next
end


certificate-inspection provides basic SSL inspection by checking certificate validity and server name. For deeper inspection (decryption and re-encryption), a deep-inspection profile is required, which necessitates installing the FortiGate's root CA certificate on client machines.



5. Initial SD-WAN Configuration



For scenarios with multiple WAN connections, configuring SD-WAN provides intelligent path selection, link health monitoring, and failover capabilities. This section outlines a basic SD-WAN setup for two WAN interfaces.



5.1. Configure a Second WAN Interface (e.g., port3)


Assume you have a second ISP connection on port3. Configure it similarly to port1:


config system interface
    edit "port3"
        set mode dhcp
        set allowaccess ping https ssh
        set description "ISP_WAN2"
    next
end


Or for static:


config system interface
    edit "port3"
        set mode static
        set ip 198.51.100.2/29 <-- Second static IP
        set allowaccess ping https ssh
        set description "ISP_WAN2"
    next
end



5.2. Create the SD-WAN Zone


Combine your WAN interfaces into an SD-WAN zone.


config system sdwan
    config zone
        edit "virtual-wan-link"
        next
    end
    config health-check
        edit "Google_DNS"
            set server "8.8.8.8"
            set protocol ping
            set interval 5
            set failtime 3
            set probe-timeout 1
        next
        edit "FortiGuard_DNS"
            set server "208.91.112.53"
            set protocol ping
            set interval 5
            set failtime 3
            set probe-timeout 1
        next
    end
    config member
        edit 1
            set interface "port1"
            set gateway 203.0.113.1 <-- Required for static WAN only
            set zone "virtual-wan-link"
        next
        edit 2
            set interface "port3"
            set gateway 198.51.100.1 <-- Required for static WAN only
            set zone "virtual-wan-link"
        next
    end
    set status enable
end


The health-check probes are crucial for monitoring link status. The gateway setting under config member is only necessary if the interface itself is configured with a static IP; DHCP-configured interfaces automatically get their gateway.



5.3. Update Firewall Policy for SD-WAN


Modify the existing "LAN-to-INTERNET" policy to use the SD-WAN zone as the destination interface.


config firewall policy
    edit 1
        set dstintf "virtual-wan-link" <-- Change destination to SD-WAN zone
    next
end



5.4. SD-WAN Rules (Performance SLAs)


Define how traffic should be routed through the SD-WAN members. For Day-1, a simple "Best Quality" rule for general internet access is common.


config system sdwan
    config service
        edit 1
            set name "Internet_Traffic"
            set src "all"
            set dst "all"
            set service "ALL"
            set sdwan-zone "virtual-wan-link"
            set strategy "best-quality"
            config health-check
                set member "Google_DNS"
                set member "FortiGuard_DNS"
            end
            config quality-criteria
                set link-cost-factor latency
                set jitter-threshold 10
                set latency-threshold 100
                set packetloss-threshold 5
            end
        next
    end
end


The best-quality strategy uses the defined health checks and quality criteria (latency, jitter, packet loss) to choose the best available link. Other strategies include "redundant" for duplicating traffic, "load-balance" for distributing traffic, and "manual" for explicit link preference.



6. Administrative Access and Time Synchronization



6.1. Change Default Admin Password


Immediately change the default 'admin' password for security.


config system admin
    edit "admin"
        set password <your_strong_password>
    next
end



6.2. Configure NTP (Network Time Protocol)


Accurate time is critical for logging, certificate validation, and security features.


config system ntp
    set status enable
    set syncinterval 60
    config ntpserver
        edit 1
            set server "0.fortiguard.pool.ntp.org"
        next
        edit 2
            set server "1.fortiguard.pool.ntp.org"
        next
    end
end



Common Pitfalls


    
    
  • Incorrect IP Addressing/Subnetting: Double-check IP addresses, subnet masks, and default gateways for all interfaces. A common mistake is configuring the FortiGate's WAN interface with the ISP's gateway IP instead of a usable IP within the assigned range.
    • 
    
  • Firewall Policy Order: Policies are processed from top to bottom. If a broader policy is above a more specific one, the broader policy might match traffic unintentionally. Always place more specific policies higher in the list.
    • 
    
  • Missing NAT: For outbound internet access, the firewall policy must have NAT enabled unless a specific routing setup dictates otherwise.
    • 
    
  • Health Checks Misconfiguration: In SD-WAN, health checks are vital. If probes are failing due to incorrect target IPs, inaccessible targets, or overly aggressive thresholds, it can lead to interfaces being marked down prematurely or incorrectly. Ensure target servers (e.g., 8.8.8.8) are reachable through the respective WAN links.
    • 
    
  • DNS Issues: Verify DNS resolution for internal clients. If FortiGate is providing DHCP, ensure it's assigning valid DNS servers (e.g., FortiGate itself, or public DNS).
    • 
    
  • Firmware Version Inconsistencies: Commands and features can vary slightly between major FortiOS versions (e.g., 6.4 vs. 7.0 vs. 7.2). Always consult the Fortinet documentation for the specific version your device is running.
    •

Back to the knowledge base · Ask the AI assistant