FortiOS: Basic FortiGate Configuration

April 15, 2026·3 min read·530 words

FortiOS is the unified operating system for FortiGate appliances. Configuration is performed through the web GUI or a CLI similar to Cisco, although it has its own specific syntax. This guide covers the basic commands for NGFW configuration: interfaces, policies, IPsec VPN, SD-WAN, and troubleshooting.

Access and Modes

HTTPS GUI: https://192.168.1.99 (default)
SSH CLI: ssh admin@192.168.1.99 (password reset required at first login)
Console port (RJ45 or USB-C depending on the model, 9600 baud 8-N-1)
get system status: system overview
execute ping 8.8.8.8: ping from the firewall

Interface Configuration

config system interface ; edit "port1" ; set mode static ; set ip 192.168.1.99/24 ; end
set allowaccess ping https ssh: services allowed on the interface
set role lan: role (lan/wan/dmz) displayed in the GUI
set alias "WAN-FAI1": custom display name
show system interface port1: verify the configuration

Zones and Addressing

config system zone ; edit "LAN" ; set interface "port1" "port2" ; end: multi-interface zone
config firewall address ; edit "NET-LAN" ; set subnet 192.168.1.0/24 ; end
config firewall addrgrp ; edit "GRP-INTERNAL" ; set member "NET-LAN" "NET-DMZ" ; end

Firewall Policies

config firewall policy
edit 1
set name "LAN-to-WAN"
set srcintf "port1"
set dstintf "port10"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set nat enable
set utm-status enable ; set ssl-ssh-profile "certificate-inspection" ; set av-profile "default"
end

Site-to-Site IPsec VPN

config vpn ipsec phase1-interface ; edit "VPN-PARIS-LYON" ; set interface "port10" ; set remote-gw 203.0.113.2 ; set psksecret MySharedKey ; end
config vpn ipsec phase2-interface ; edit "VPN-PARIS-LYON-P2" ; set phase1name "VPN-PARIS-LYON" ; set src-subnet 192.168.1.0/24 ; set dst-subnet 10.10.1.0/24 ; end
config firewall policy: create a policy allowing traffic between the LAN and the tunnel
diagnose vpn ike gateway list: view phase 1 status
diagnose vpn tunnel list: view phase 2 status

SD-WAN

config system sdwan ; set status enable ; config members ; edit 1 ; set interface "port10" ; set gateway 203.0.113.1 ; end
config health-check ; edit "HTTP-probe" ; set server "8.8.8.8" ; set protocol ping ; end
config service ; edit 1 ; set name "Internet" ; set mode sla ; set sla 1 ; end

Routing

config router static ; edit 1 ; set dst 0.0.0.0 0.0.0.0 ; set gateway 203.0.113.1 ; set device "port10" ; end
config router bgp ; set as 65001 ; config neighbor ; edit "203.0.113.2" ; set remote-as 65002 ; end
get router info routing-table all: routing table

Essential Troubleshooting

diagnose debug flow filter saddr 192.168.1.50 ; diagnose debug flow show function-name enable ; diagnose debug flow trace start 100: trace packets
diagnose debug enable: enable debugging
diagnose debug disable: stop debugging
get hardware status: CPU/RAM/sessions
diagnose sys top: top processes
execute log filter field srcip 192.168.1.50 ; execute log display: view logs

HA (High Availability)

config system ha ; set mode a-p ; set group-name HA-OPTINOC ; set password MyHAPass ; set priority 150 ; set hbdev "port9" 50 "port10" 50 ; end
get system ha status: HA status
execute ha synchronize all: force synchronization

Order from OPTINOC

FortiGate appliances preconfigured with VPN, SD-WAN, and HA to meet your requirements. 24×7 support from French-speaking experts included. FortiOS training for customers.