FortiGate Overview and Initial Setup

A FortiGate is a hardware or virtual device made by Fortinet that acts as a next-generation firewall. 'Next-generation' means it does more than just stop unwanted traffic: it can also inspect the content inside the traffic (like checking a package for illegal items without opening it), stop viruses, prevent intrusions, and control which applications employees can use. A firewall, in general, is a system that decides which data can enter or leave a private network based on pre-set rules.

To understand initial setup, you need to know three core ideas: interfaces, administrative access, and firmware.

Interfaces are the physical or virtual network ports on the FortiGate. Each interface is a connection point where you plug in a network cable. A typical FortiGate has several interfaces labelled with names like 'port1', 'port2', 'port3', and so on. When you first power on a FortiGate, every interface is a blank slate — it has no internet protocol (IP) address, no connection to a network, and no defined role. An IP address is a unique number assigned to each device on a network, like a postal address for your computer. You must assign an IP address to each interface you plan to use, and you must decide which network that interface connects to. The most common setup is to designate one interface as the 'WAN' (wide area network) port that connects to your internet service provider's modem, and another interface as the 'LAN' (local area network) port that connects to the switches and computers inside your office. The FortiGate then acts as a bridge between these two networks, inspecting all traffic that passes from one to the other.

Administrative access is the set of methods you enable so that IT staff can log into the FortiGate to manage it. You never want a stranger to be able to reach the FortiGate's control panel, so you deliberately turn on only the access methods you need and restrict them to trusted IP addresses. The common access methods are:

Each interface can have its own set of allowed access methods. For example, you might allow HTTPS and SSH on the LAN interface so your IT team can manage the device from inside the building, but you would disable all administrative access on the WAN interface to prevent attackers from trying to hack the FortiGate from the internet.

Firmware is the operating system that runs on the FortiGate, called FortiOS. Like Windows or macOS, FortiOS gets updates that fix errors, close security holes, and add new features. A firmware upgrade is the process of installing a newer version of FortiOS onto the device. Before you do anything else with a new FortiGate, you should check whether it is running the latest stable firmware version supported by Fortinet. Why? Because an older firmware might have known vulnerabilities that attackers could exploit to break into your network. Upgrading is done through the web interface or command line, and it requires you to download the official firmware image file from Fortinet and upload it to the device. The FortiGate then reboots with the new operating system.

Why does this matter in a real network? Imagine a company with 200 employees. They install a FortiGate to block malicious websites and prevent hackers from stealing customer data. If the IT team leaves the default interface settings unchanged, the FortiGate might have no IP address (so it cannot send or receive any data), or it might have a default password that attackers can guess in seconds. If they never upgrade the firmware, the device may be running software with a known security flaw that lets attackers bypass the firewall entirely. The initial setup steps — configuring interfaces, locking down administrative access, and upgrading firmware — are the absolute minimum required to make the FortiGate secure and functional. The steps exist precisely because a default-out-of-the-box device is both unusable and unsafe.

Imagine you are the first IT hire at a small company that has just bought its first FortiGate 60F model. The CEO hands you the box and says, 'Make us secure.' You take the device out, plug in the power cable, and connect port1 to the company's cable modem (the internet connection) using an Ethernet cable. You connect port2 to the office switch (the device that connects all the employee computers). This is already a critical step: you have physically designated which interface is WAN and which is LAN.

Now you need to perform the initial configuration. You turn on the FortiGate and wait for it to boot. By default, the FortiGate has a factory IP address of 192.168.1.99 on the LAN interface. You set your own laptop to a compatible IP address (for example, 192.168.1.100), connect your laptop to port2, and open a web browser to https://192.168.1.99. You log in with the default username 'admin' and no password. The first thing the FortiGate forces you to do is change that default password — a security step that prevents anyone who guesses the default credentials from taking over the device. You set a strong password.

Next, you go to the Network > Interfaces section. You configure port1 (the WAN interface): you assign it the IP address your internet service provider gave you (for example, a public IP like 203.0.113.5) or set it to obtain an IP automatically via DHCP (dynamic host configuration protocol, where a router automatically assigns an IP). You then configure port2 (the LAN interface): you assign it an IP address for the company's internal network, like 10.0.0.1, with a subnet mask of 255.255.255.0. This means every device in the office will get an IP in the range 10.0.0.2 to 10.0.0.254.

After setting the interfaces, you restrict administrative access. On the LAN interface (port2), you enable HTTPS and SSH so you and your IT colleague can manage the FortiGate from inside the office. On the WAN interface (port1), you disable all administrative access methods — no HTTPS, no SSH, no ping — because you do not want anyone on the internet to attempt to log into the FortiGate. You also create an 'administrative access control' rule that only allows management traffic from a specific trusted host, such as the laptop you use, using its IP address.

Finally, you upgrade the firmware. You check the Fortinet support site and see that the FortiGate shipped with FortiOS version 7.0.1 but the latest stable version is 7.2.5. You download the firmware image file (a file ending in .out, the standard Fortinet firmware file extension). You go to System > Firmware, upload the file, and click Upgrade. The FortiGate installs the new firmware and reboots. After the reboot, you log back in and confirm the version number has changed.

Throughout this process, you are doing what every IT professional does: you are taking a generic security appliance and tailoring it to your specific environment. The interfaces become the boundaries of your network. The administrative access settings create a locked door that only you can open. The firmware upgrade ensures the device is running the most secure and capable version of its software. Without these steps, the FortiGate would be like a guard shack at the factory gate with no guard inside, no lock on the door, and a broken radio — completely useless for security.