1.1 Initial Configuration, GUI/CLI Management & Admin Profiles

Initial Configuration, GUI/CLI Management & Admin Profiles

Deploying a FortiGate Security Processing Unit (SPU) into a enterprise production architecture requires establishing secure administrative channels, configuring interface management parameters, hardening global system settings, and defining Role-Based Access Control (RBAC) administrator profiles. FortiOS 7.6 provides granular administrative controls through both the Graphical User Interface (GUI) and the Command Line Interface (CLI).

---

Factory Default Settings & Out-of-Band Provisioning

When a FortiGate physical appliance or virtual machine (FortiGate-VM) is powered on for the first time or subjected to a factory reset (execute factoryreset), FortiOS initializes with a standardized base configuration designed for out-of-band management access.

Core Factory Defaults

During initial provisioning, connecting a administrator workstation to port1 via Ethernet triggers DHCP assignment. Accessing https://192.168.1.99 in a web browser presents the FortiOS GUI login prompt, forcing the administrator to change the blank default password before accessing the dashboard.

---

Interface Management Protocols & Allowed Access

FortiOS strictly controls administrative access at the network interface layer. By default, non-management interfaces have all administrative access protocols disabled. To configure administrative protocols on a specific physical or logical interface, administrators must define the allowaccess parameter.

Supported Interface Administrative Protocols

• HTTPS (Port 443): Encrypted web GUI access utilizing TLS 1.2/1.3.
• HTTP (Port 80): Unencrypted web GUI access (disabled by default; strongly discouraged in production).
• SSH (Port 22): Secure Shell CLI access for interactive terminal sessions.
• TELNET (Port 23): Unencrypted CLI access (disabled by default).
• PING: Internet Control Message Protocol (ICMP) echo response for reachability testing.
• FMG-Access (Port 541): FortiManager central management communication channel.
• FortiTelemetry (Port 8013): Security Fabric telemetry and inter-device fabric communications.
• RADIUS-Single-Sign-On (RSSO): Listens for RADIUS accounting packets.

Configuring Interface Allowed Access via CLI

config system interface
    edit "port1"
        set vdom "root"
        set ip 10.0.1.99 255.255.255.0
        set allowaccess ping https ssh fortitelemetry fmg-access
        set type physical
        set description "Out-of-Band Management Network"
    next
end

[!WARNING] Disabling https or ssh on the interface currently used for administrative connection will instantly terminate your active CLI or GUI session. Always ensure an alternative physical interface or console port connection is accessible when modifying interface allowaccess parameters.

---

Global System Hardening & Management Port Customization

To mitigate automated brute-force attacks and port scanning, security best practices dictate changing default administrative service listening ports, enforcing aggressive session timeouts, and customizing system identification banners under config system global.

config system global
    set hostname "FGT-HQ-CORE-01"
    set admintimeout 15
    set admin-sport 8443
    set admin-ssh-port 2222
    set admin-lockout-threshold 3
    set admin-lockout-duration 600
    set admin-scp enable
    set gui-theme mariner
end

Key Global Management Settings

• admintimeout: Controls the maximum idle duration (in minutes) before an inactive GUI or CLI administrative session is automatically terminated (range: 1–480 minutes; default: 15 minutes).
• admin-sport: Changes the custom listening TCP port for HTTPS GUI access (e.g., port 8443).
• admin-ssh-port: Changes the custom listening TCP port for SSH CLI access (e.g., port 2222).
• admin-lockout-threshold: Defines the number of consecutive failed login attempts before locking out an administrative account (default: 3).
• admin-lockout-duration: Specifies the duration in seconds that an administrative account remains locked out following threshold breach (default: 60 seconds).

---

Administrator Profiles & Role-Based Access Control (RBAC)

FortiOS implements Role-Based Access Control (RBAC) by separating administrator identity from access permissions. An administrator account is bound to an Admin Profile, which dictates granular Read, Read-Write, or No Access permissions across specific system features.

Predefined Administrator Profiles

Custom Administrator Profile Granularity

Custom administrator profiles can be created under config system accprofile to enforce the Principle of Least Privilege (PoLP). Permissions are segmented into broad categories:

1. System: Administrative users, interface settings, maintenance, HA, and network routing.
2. Firewall: Security policies, address objects, service objects, NAT rules, and schedules.
3. Security Profiles: Antivirus, IPS, Web Filter, Application Control, and SSL Inspection profiles.
4. Log & Report: Log settings, diagnostic tools, report generation, and log viewing.
5. VPN: IPsec VPN, SSL VPN settings, and portal configurations.

config system accprofile
    edit "SOC-Tier1-Operator"
        set secprofrgrp read
        set fwgrp read
        set loggrp read-write
        set sysgrp read
        set utmgrp read
    next
end

---

Administrator Account Hardening: Trusted Hosts & 2FA

Administrative accounts can be hardened against credential theft and unauthorized remote access by enforcing Trusted Hosts and Two-Factor Authentication (2FA).

Trusted Hosts Architecture

Trusted Hosts restrict administrative login attempts for a specific account to a maximum of 10 IPv4 or IPv6 subnets/addresses. When Trusted Hosts are defined on an admin user, FortiOS evaluates the source IP address of incoming TCP/IP connection requests before initiating password verification or TLS handshakes.

config system admin
    edit "secops_admin"
        set remote-auth disable
        set accprofile "SOC-Tier1-Operator"
        set vdom "root"
        set trusthost1 10.10.50.0 255.255.255.0
        set trusthost2 192.168.100.25 255.255.255.255
        set password ENC string_hash_blob
    next
end

[!IMPORTANT] If an administrator configures Trusted Hosts on their user account and attempts to log in from an unlisted IP address, FortiOS silently drops the connection request without displaying a login prompt. If all 10 trusted host slots are left at 0.0.0.0 0.0.0.0, connections are accepted from any IP address.

Multi-Factor Authentication Integration

FortiOS supports native 2FA using FortiToken (Physical hardware tokens or FortiToken Mobile push notifications), Email tokens, SMS tokens, and RADIUS/SAML external Identity Providers (IdP).

config system admin
    edit "secops_admin"
        set two-factor fortitoken
        set fortitoken "FTK200123456789"
        set email-to "secops@enterprise.com"
    next
end

---

Configuration Revision Control, Backup & Restoration

Maintaining verified configuration backups is critical for disaster recovery and change compliance. FortiOS supports manual configuration backups, scheduled backups, and automated revision tracking via an internal revision database.

Configuration Backup CLI Syntax

# Backup configuration file to an external TFTP server
execute backup config tftp FGT-HQ-CORE-01_20260730.conf 10.10.10.50

# Backup configuration with encryption password to local USB media
execute backup config usb FGT-HQ-CORE-01_20260730.conf EncryptedPass123!

Configuration Restore CLI Syntax

# Restore configuration from TFTP server (Triggers automatic system reboot)
execute restore config tftp FGT-HQ-CORE-01_20260730.conf 10.10.10.50

---

Administrative Protocol Security & Port Reference

The following table outlines the security status and default port configurations for management protocols: