2.2 System Configuration & FortiGuard

Initial Setup and Administrative Access

A new FortiGate ships with a default administrator account named admin that has no password — changing this password is the first hardening step. The web GUI is reached over HTTPS on port 443 by default, and the CLI is reached over SSH on port 22. Out of the box, a designated port (often port1 or a dedicated mgmt interface) has a factory IP such as 192.168.1.99.

Each FortiGate interface has an allowaccess list that controls which management protocols are permitted on that interface. Common values include:

Hardening best practice is to remove HTTP and TELNET, limit HTTPS/SSH to management interfaces only, and use trusted host restrictions on admin accounts so administration is allowed only from specific source IP ranges.

DNS and System Time

The FortiGate needs working DNS to resolve FortiGuard servers, FQDN address objects, and update servers; primary and secondary DNS servers are set under system DNS settings. System time should be synchronized using NTP (Network Time Protocol) — accurate time is essential for valid log timestamps, certificate validation, and scheduled policies. Time and NTP settings are configured under System > Settings in the GUI.

Administrator Accounts and Profiles

Administrator accounts can authenticate locally (password stored on the FortiGate) or against a remote server (RADIUS, LDAP, or TACACS+). Each account is bound to an administrator profile (also called an access profile) that defines what the administrator can see and change.

• super_admin — A built-in profile granting full read/write access to every part of the configuration. The default admin account uses this profile. It cannot be edited or deleted.
• Custom profiles — Administrators can create profiles that grant read-only, read-write, or none access per feature area (firewall, VPN, system, logging, etc.), supporting role-based delegation.

Additional account controls include trusted hosts (restricts the source IPs an admin can connect from), two-factor authentication, idle timeout, and password policy enforcement.

Firmware Upgrade Path

FortiOS firmware should be upgraded following the Fortinet supported upgrade path — you generally upgrade one major version at a time (for example 7.2 to 7.4 to 7.6) rather than jumping multiple versions, because skipping versions can corrupt the configuration migration. Always read the release notes, confirm hardware support, and back up the configuration before upgrading. Downgrading firmware typically resets the device to factory defaults, so a backup is critical.

Configuration Backup and Restore

The full FortiGate configuration can be backed up to a file from the GUI (System dashboard) or the CLI (execute backup config). Key points:

• Backups can be plain text or encrypted with a password; an encrypted backup can only be restored to a device using the same password.
• An unencrypted backup from one model generally cannot be restored to a different model.
• The configuration revision feature stores multiple saved revisions on the device (or on FortiManager), allowing quick rollback after a change.
• Restoring a configuration usually requires a reboot.

FortiGuard Subscription Services

FortiGuard is Fortinet's threat-intelligence and update service. Security features depend on FortiGuard subscription licenses activated per device. Major services include:

The FortiGate downloads signature packages and queries live ratings from the FortiGuard Distribution Network (FDN). Signature package updates (AV, IPS, app control) are pulled on a schedule or pushed by FortiGuard, while web and DNS rating lookups are real-time queries cached locally. All FortiGuard traffic is sent from the management VDOM, so its internet path and DNS must be working. The license status and last update time are visible on the FortiGuard settings page; an expired license stops updates and rating lookups.