FortiOS: Basic FortiGate Configuration
·3 min read·530 words
FortiOS is the unified operating system for FortiGate appliances. Configuration is performed through the web GUI or a CLI similar to Cisco, although it has its own specific syntax. This guide covers the basic commands for NGFW configuration: interfaces, policies, IPsec VPN, SD-WAN, and troubleshooting.
Access and Modes
- HTTPS GUI: https://192.168.1.99 (default)
- SSH CLI: ssh admin@192.168.1.99 (password reset required at first login)
- Console port (RJ45 or USB-C depending on the model, 9600 baud 8-N-1)
- get system status: system overview
- execute ping 8.8.8.8: ping from the firewall
Interface Configuration
- config system interface ; edit "port1" ; set mode static ; set ip 192.168.1.99/24 ; end
- set allowaccess ping https ssh: services allowed on the interface
- set role lan: role (lan/wan/dmz) displayed in the GUI
- set alias "WAN-FAI1": custom display name
- show system interface port1: verify the configuration
Zones and Addressing
- config system zone ; edit "LAN" ; set interface "port1" "port2" ; end: multi-interface zone
- config firewall address ; edit "NET-LAN" ; set subnet 192.168.1.0/24 ; end
- config firewall addrgrp ; edit "GRP-INTERNAL" ; set member "NET-LAN" "NET-DMZ" ; end
Firewall Policies
- config firewall policy
- edit 1
- set name "LAN-to-WAN"
- set srcintf "port1"
- set dstintf "port10"
- set srcaddr "all"
- set dstaddr "all"
- set action accept
- set schedule "always"
- set service "ALL"
- set nat enable
- set utm-status enable ; set ssl-ssh-profile "certificate-inspection" ; set av-profile "default"
- end
Site-to-Site IPsec VPN
- config vpn ipsec phase1-interface ; edit "VPN-PARIS-LYON" ; set interface "port10" ; set remote-gw 203.0.113.2 ; set psksecret MySharedKey ; end
- config vpn ipsec phase2-interface ; edit "VPN-PARIS-LYON-P2" ; set phase1name "VPN-PARIS-LYON" ; set src-subnet 192.168.1.0/24 ; set dst-subnet 10.10.1.0/24 ; end
- config firewall policy: create a policy allowing traffic between the LAN and the tunnel
- diagnose vpn ike gateway list: view phase 1 status
- diagnose vpn tunnel list: view phase 2 status
SD-WAN
- config system sdwan ; set status enable ; config members ; edit 1 ; set interface "port10" ; set gateway 203.0.113.1 ; end
- config health-check ; edit "HTTP-probe" ; set server "8.8.8.8" ; set protocol ping ; end
- config service ; edit 1 ; set name "Internet" ; set mode sla ; set sla 1 ; end
Routing
- config router static ; edit 1 ; set dst 0.0.0.0 0.0.0.0 ; set gateway 203.0.113.1 ; set device "port10" ; end
- config router bgp ; set as 65001 ; config neighbor ; edit "203.0.113.2" ; set remote-as 65002 ; end
- get router info routing-table all: routing table
Essential Troubleshooting
- diagnose debug flow filter saddr 192.168.1.50 ; diagnose debug flow show function-name enable ; diagnose debug flow trace start 100: trace packets
- diagnose debug enable: enable debugging
- diagnose debug disable: stop debugging
- get hardware status: CPU/RAM/sessions
- diagnose sys top: top processes
- execute log filter field srcip 192.168.1.50 ; execute log display: view logs
HA (High Availability)
- config system ha ; set mode a-p ; set group-name HA-OPTINOC ; set password MyHAPass ; set priority 150 ; set hbdev "port9" 50 "port10" 50 ; end
- get system ha status: HA status
- execute ha synchronize all: force synchronization
Order from OPTINOC
FortiGate appliances preconfigured with VPN, SD-WAN, and HA to meet your requirements. 24×7 support from French-speaking experts included. FortiOS training for customers.