How do you stop an attacker from logging into your FortiGate firewall and changing all the security rules? The answer is 'System Administration and Management' — the system that controls who can access the device, what they can do once inside, and which doors (HTTP, HTTPS, SSH, CLI, or FortiExplorer) they are allowed to use. For the NSE4 exam, mastering this topic means you understand how to lock down the management plane itself, which is the first line of defence against insider threats and hackers.
Jump to a section
A simple way to picture System Administration and Management
You are the manager of a high-end nightclub called 'NetworkSecure'. On a busy Friday night, hundreds of people want to get in. You cannot just open the doors to everyone, because chaos would erupt — fights, property damage, and the police shutting you down. So who gets in? The VIPs with special wristbands? The staff with IDs? The delivery drivers for the kitchen?
You need a system. You hire a bouncer (the FortiGate firewall) and give them a list of rules called an 'administrative profile.' This list says: this person can enter through the front door (HTTPS), that person can only use the back alley entrance (SSH), and some people cannot even approach the building. The bouncer checks each person's ID (authentication) when they arrive. If their ID matches a rule, they get a specific access level. For example, a DJ gets full access to the booth (super admin), a cleaner can only enter the bathrooms (read-only), and a bouncer trainee can only use a walkie-talkie on the guest list (CLI access only).
Without this structure, you would have to personally decide every single entry request — which is impossible on a busy night. Instead, you pre-define the 'administrator accounts' and their 'profiles' during the afternoon setup, so the bouncer works automatically. This is exactly how FortiOS system administration works: you create accounts, assign profiles, and define which management access methods (HTTP, HTTPS, SSH, CLI, FortiExplorer) each account can use. The bouncer (the FortiGate) enforces those rules every time someone tries to manage the device.
System Administration and Management on a FortiGate firewall is the practice of controlling who can log in to the device and what they are permitted to do. It is absolutely critical because if an attacker gains administrative access to your firewall, they can disable security policies, steal data, or use your network as a launchpad for attacks on others. This chapter covers three main pillars: administrative profiles, administrator accounts, and management access methods.
First, let us define the terms. An 'administrator account' is a username and password (or certificate) that identifies a person or automated system allowed to access the FortiGate. Think of it like a key card for a building. However, simply having a key card does not tell you which rooms the person may enter. That is where an 'administrative profile' comes in — it is a set of permissions that defines what actions a specific administrator can perform. For example, a 'super_admin' profile grants full read-write access to every setting, while a 'read_only' profile lets the user see configurations but never make changes. The NSE4 exam expects you to know that there are predefined profiles (like 'super_admin', 'prof_admin', 'read_only') and you can also create custom profiles to match your organisation's specific needs.
Next, we look at how administrators actually connect to the device. This is called a 'management access method'. FortiGate supports several methods:
HTTP: Hypertext Transfer Protocol, a basic web protocol used to access the FortiGate's web interface (called the GUI or Graphical User Interface). HTTP is not encrypted, so passwords and data are sent in plain text — this is a security risk for production environments.
HTTPS: Hypertext Transfer Protocol Secure, which is the encrypted version of HTTP using SSL/TLS. This is the recommended method for web-based management because it protects your credentials from eavesdropping.
SSH: Secure Shell, a protocol that provides encrypted command-line access. This is the primary method for using the CLI (Command Line Interface), where you type text commands instead of clicking buttons.
CLI: The Command Line Interface itself is not a protocol — it is a text-based interface you reach via SSH or by connecting directly to the console port of the device. On the NSE4 exam, they often ask which method uses text-based commands (the answer is CLI).
FortiExplorer: A desktop or mobile application that provides a simplified management interface for FortiGate devices. It is often used for initial setup because it guides you through the configuration wizard.
Why do we need multiple methods? Different situations demand different tools. For day-to-day remote management, an IT professional might use HTTPS on a laptop browser. For scripting automated backups, they might use SSH and the CLI. For troubleshooting a device that has lost network connectivity, they plug directly into the console port and use a terminal program like PuTTY. The key security principle is: you should disable any access method that is not needed. For example, if nobody uses HTTP, turn it off to reduce the attack surface.
Finally, you must understand the concept of 'trusted hosts'. This is a security feature that allows you to restrict which IP addresses can connect to the FortiGate using a specific management method. For instance, you could configure that HTTPS access is only allowed from the company's internal IP range (192.168.1.0/24) and deny it from the Internet entirely. This massively reduces the risk of a brute-force attack from a remote hacker. On the exam, you will see questions that ask you to identify the correct syntax for trusted hosts or to predict what happens when trusted hosts are misconfigured.
In summary, System Administration and Management is about identity (who you are), permissions (what you can do), and transport (how you connect). The FortiGate firewall enforces these rules at the management plane level, before any traffic inspection or security policies are applied. For a beginner, the most important takeaway is: always use HTTPS or SSH, never plain HTTP for remote management, and always restrict administrative access to trusted IP addresses.
Access the FortiGate Management Interface
You need to connect to the FortiGate to start configuring administration. Typically, you open a web browser and type the IP address of the FortiGate's management interface (e.g., https://192.168.1.99). This uses HTTPS to encrypt your session. If you are at the console port, you use a terminal program like PuTTY. This step matters because it establishes the initial connection — without the right method (HTTPS or SSH), you cannot manage the firewall at all.
Log in with Default or Existing Credentials
For a new FortiGate, the default username is 'admin' and the password is blank (or set during initial setup). You log in and immediately see a warning to change the password. In a corporate environment, your system administrator gives you a pre-configured account. This step is critical because authentication verifies you are authorised to manage the device — it is the first gatekeeper against unauthorised access.
Navigate to System > Administrators
Within the web GUI, you locate the 'System' menu in the top navigation bar, then click 'Administrators' under the 'Administration' section. This screen lists all current administrator accounts. Understanding where this menu lives is key — the NSE4 exam tests whether you know the correct path to create or edit administrators.
Create a New Administrator Account
Click 'Create New'. You fill in a username (e.g., 'raj_network'), select the authentication type (e.g., Local, RADIUS, or LDAP), and enter a strong password. You then assign an administrative profile from a dropdown list (e.g., 'super_admin' or a custom profile). Also, you set trusted hosts if needed. This step is the core of the process — each account is a combination of identity and permissions. If you skip the trusted host, the account can be accessed from any IP, which is a security risk.
Configure Management Access for the Interfaces
Go to 'System > Network > Interfaces'. Select the interface through which administrators will connect (e.g., the LAN port). In the 'Administrative Access' section, check boxes for HTTPS, SSH, or other methods you want to allow. You should uncheck HTTP. This step ensures that only the desired protocols are available on that interface. Misconfiguring this (e.g., enabling HTTP on the WAN interface) is a common security vulnerability that the NSE4 exam will test.
Test and Verify Access
Log out and log back in using the newly created account. Try connecting via HTTPS first, then via SSH if you enabled it. Verify that you cannot connect using HTTP (the browser should error out). Also, check that an unauthorised user from a different IP cannot access the GUI. This validation step is often overlooked in real deployments, but it confirms that your configuration works as intended and no mistakes were made in step 4 or 5.
Imagine you are the IT administrator for a medium-sized company called 'CloudServ Ltd.' The company uses a single FortiGate 100F firewall to protect its head office and remote workers. You are responsible for managing this firewall, and you need to give different levels of access to three colleagues:
The network engineer, Raj, needs full control to configure VPN tunnels and security policies.
The helpdesk technician, Priya, only needs to check the system logs and view the current connections. She should never make changes.
The intern, Tom, is learning network security and should only have read-only access to the dashboard and a few basic reports.
Here is what you do step by step in a real FortiGate environment: you log in as the super_admin account with HTTPS, because it is secure. First, you go to 'System > Administrators'. You create three new administrator accounts: one for Raj, one for Priya, and one for Tom. You assign strong passwords and ensure each account is linked to an email address for password recovery alerts.
Next, you create custom administrative profiles. You cannot use the default 'super_admin' for everyone because that would give Tom full power. Instead, you create a profile called 'Network_Admin' with read-write access to 'System Configuration', 'Security Profiles', and 'Policy & Objects'. For Priya, you create a profile called 'Helpdesk_Read' with read-only permission to 'Logs' and 'Monitoring'. For Tom, you create a 'Dashboard_View' profile that only allows viewing the system dashboard and nothing else. Then you assign these profiles to the respective accounts.
Now you configure the management access methods. You know that the firewall's management interface is exposed to the local LAN (192.168.1.0/24) and also to a VPN IP range (10.10.10.0/24) for remote management. You disable HTTP because it is insecure. You enable HTTPS and SSH. For SSH, you set a trusted host restriction so that only the VPN IP range can connect. This prevents someone on the local coffee shop Wi-Fi from trying to SSH into the firewall.
Finally, you test everything. You ask Raj to connect via SSH from his desk. He types 'ssh admin@192.168.1.1' and gets in. He then runs a command to check the VPN status. Priya logs in via HTTPS and sees the logs but cannot edit anything — every edit button is greyed out. Tom tries to log in via HTTP, but the connection is refused because you disabled it. He uses HTTPS, gets to the dashboard, and can see the CPU usage graph but nothing else.
Later that week, you receive an alert that someone tried to log in with the username 'admin' from a foreign IP address 50 times in one minute. Because you enabled 'admin lockout' and set the threshold to 5 failed attempts, the account is temporarily locked. You review the logs and realise that no successful login occurred. This is exactly how System Administration and Management protects the device from brute-force attacks.
In a real business, you would also configure 'password policies' to enforce complexity (e.g., minimum 12 characters, special characters, and a change every 90 days) and set up 'two-factor authentication' (2FA) for super_admin accounts. The NSE4 exam covers these security measures in the context of best practices for system administration.
The NSE4 exam loves to test System Administration and Management because it underpins everything else on the firewall. Expect about 5-8 questions on this topic, spread across multiple-choice, multiple-select, and drag-and-drop formats. Here are the exact concepts they focus on:
Administrative profiles: the exam asks you to match predefined profiles to their correct permissions. For example, you must know that 'prof_admin' has read-write access for all system configuration except system admin settings, and 'super_admin' has full access. A common trap is the 'read_only' profile — it does not mean the user can see everything. It only allows read access to objects that the profile's scope permits. Some objects, like password hashes, are never visible even to read_only users.
Management access methods: you must know which protocols are encrypted and which are not. HTTP is plain text — never use it in production. HTTPS and SSH are encrypted. CLI is not a protocol; it is an interface. FortiExplorer uses HTTPS under the hood but offers a streamlined interface. The exam may present a scenario where an administrator cannot connect via HTTPS but can via SSH, and ask you to identify the issue — often it is because the HTTPS service is disabled on the specific interface.
Trusted hosts: this is a high-yield exam topic. The exam will ask you to configure trusted hosts for an administrator. The correct pattern is: 'config system admin' then 'edit admin_name', then 'set trusthost1 192.168.1.0 255.255.255.0'. They love to test that trusted hosts are IP/network pairs, not just IP addresses. A trick: if you set a trusted host but the administrator's IP is outside that range, the administrator cannot log in at all — even with a correct password.
Administrator types: you need to differentiate between 'local' administrators (stored on the FortiGate itself), 'remote' administrators (authenticated through a central server like RADIUS or LDAP), and 'PKI' administrators (certificate-based authentication). The exam often asks: 'Which administrator type is best for a company with 500 employees? Answer: remote authentication via LDAP to avoid managing local accounts on each firewall.
Password management: the exam tests 'password policy' options under 'system admin settings'. You must know how to set minimum length, expiration, and lockout thresholds. A common question: 'What happens after 5 failed login attempts with admin lockout enabled?' The answer is that the administrator account is locked for the configured lockout duration (default 60 seconds) or until manually unlocked.
Backup and restore: while not strictly part of this objective, the NSE4 bundles system administration with config backup. Know that you can back up the configuration via 'System > Dashboard' using the 'Backup' button. The backup file is encrypted if you set a password. You must know that restoring a configuration resets the system to the state of the backup, overwriting the current config.
Common trap patterns:
Trap 1: mixing up 'administrator account' with 'administrative profile'. Remember: accounts are the users, profiles are the permission sets.
Trap 2: thinking that disabling HTTP still allows HTTPS — true, but they may ask what happens if HTTPS is disabled: the GUI becomes inaccessible.
Trap 3: assuming all administrators see the same dashboard. In reality, the dashboard widgets are per-administrator.
Trap 4: forgetting that the 'admin' default account cannot be deleted — only renamed or disabled.
Trap 5: thinking that console port access does not require authentication — it does, using local credentials.
To memorise: write down the port numbers — HTTP (80), HTTPS (443), SSH (22), and Telnet (23, but legacy and disabled by default). The exam will quiz you on these.
The FortiGate firewall uses three distinct layers for management control: administrator accounts (who you are), administrative profiles (what you can do), and management access methods (how you connect).
HTTPS (port 443) and SSH (port 22) are the only recommended remote management protocols because they encrypt all traffic, including passwords.
Trusted hosts restrict which IP addresses can log in to an administrator account — if the client IP does not match any trusted host, login is denied regardless of the password.
The default 'admin' account has super_admin privileges by default and can manage the firewall over any enabled interface — it should be renamed or disabled for security.
Administrative profiles are reusable permission sets that can be assigned to multiple accounts, allowing you to standardise roles like 'read_only' or 'prof_admin' across the organisation.
Password policies, admin lockout thresholds, and two-factor authentication are critical security settings that prevent brute-force attacks against the management interface.
These come up on the exam all the time. Here's how to tell them apart.
HTTP
Uses port 80 by default
Data is sent in plain text (unencrypted)
Not recommended for any management access in production
HTTPS
Uses port 443 by default
Data is encrypted using SSL/TLS
Recommended for all web-based management access
Administrator Account
Defines the user identity (username and password)
Can be stored locally, on a remote server, or via PKI
Each account has exactly one associated username
Administrative Profile
Defines the set of permissions (read, write, none)
Is a reusable template that can be assigned to multiple accounts
Profiles like 'super_admin' or 'read_only' are predefined
Local Administrator
Credentials stored directly on the FortiGate
Best for small environments with few administrators
Every firewall must be updated individually if passwords change
Remote Administrator (LDAP/RADIUS)
Credentials verified by an external authentication server
Best for large organisations with many administrators
Centralised password management — change password once on the server
CLI (Command Line Interface)
Accessed via SSH or console port
Requires typing text commands (e.g., 'config system admin')
Faster for scripting and bulk changes; no mouse needed
GUI (Graphical User Interface)
Accessed via HTTPS in a web browser
Uses menus, buttons, and forms for configuration
Easier for beginners; all options visible visually
Trusted Host
Limits login to specific IP addresses or subnets
Reduces attack surface by blocking unauthorised IPs
Must be manually configured for each administrator account
No Trusted Host (Default)
Allows login from any IP address that can reach the FortiGate
Increases risk of brute-force attacks from the Internet
Default setting; less secure but simpler for initial setup
Mistake
A 'read-only' administrative profile means the user cannot see anything sensitive — they can view all configurations safely.
Correct
A 'read-only' profile still allows viewing system logs, current configurations, and some security settings. It prevents making changes but does not hide sensitive data like certificate private keys or password hashes. Use 'scope' within the profile to limit what objects are visible.
Beginners confuse 'read-only' with 'no visibility'. They think read-only is safe for anyone, but in reality, viewing firewall rules reveals your security posture — a huge risk for insiders.
Mistake
You must use HTTPS for all administrative access because it is the only secure method.
Correct
HTTPS is secure for web-based GUI access, but SSH provides an equally secure command-line interface. FortiExplorer also uses HTTPS. In practice, many IT professionals use SSH for scripting and automation, which is also encrypted. The choice depends on the task.
People overestimate the importance of the GUI and forget that many administrative tasks are better performed via CLI for speed and automation. They assume HTTPS is mandatory because they see it in the GUI setup wizards.
Mistake
Disabling HTTP completely blocks the ability to access the FortiGate via a web browser.
Correct
Disabling HTTP only blocks unencrypted web access. You can still access the FortiGate via HTTPS (using port 443) which is encrypted and secure. The two are independent services that can be separately enabled or disabled on each interface.
When people see 'HTTP' and 'HTTPS' they think they are the same thing — one is just the secure version. But they are separate protocols with separate ports. Beginners often disable both thinking they are disabling the same function.
Mistake
The default 'admin' account cannot be used to manage the FortiGate remotely — it is only for console access.
Correct
The default 'admin' account works over all management access methods (HTTPS, SSH, CLI) by default. However, it is a security best practice to rename or disable this account and create a new one for daily use, because the 'admin' username is widely known to attackers.
Beginners assume the default account is somehow limited to local console, but FortiOS does not enforce that. This misconception comes from some other devices where default accounts are indeed restricted. On FortiGate, the default admin has full super_admin privileges across all interfaces.
Mistake
You cannot create multiple administrator accounts with the same administrative profile.
Correct
You can assign the same administrative profile to as many administrator accounts as you like. For example, you could have three helpdesk staff all using the 'read_only' profile. The profile defines permissions, not identity.
People think profiles are tied one-to-one with accounts because they see them in a dropdown list for each account. They assume choosing a profile 'uses it up'. In reality, profiles are templates that can be shared.
Mistake
If an administrator forgets their password, you must factory reset the FortiGate to regain access.
Correct
If you have a super_admin account, you can reset another administrator's password from the GUI or CLI without affecting the rest of the configuration. If you forget the super_admin password itself, you can perform a password recovery procedure (booting into maintenance mode) without a full factory reset.
This is a panic-driven misconception. Beginners hear 'I lost the admin password' and assume the worst. But FortiOS has a built-in recovery mechanism that is safe and documented.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
An administrator account is a username and password that identifies a person or system allowed to access the FortiGate. An administrative profile is a set of permissions that defines what that account can do, like read-only or read-write. Profiles are reusable templates; accounts are the actual login credentials.
If you have another super_admin account, log in and go to System > Administrators, select the account, and edit the password. If you lose the only super_admin password, you can boot the FortiGate into maintenance mode and perform a password recovery procedure without losing the configuration.
Technically yes, but it is a security risk because the username 'admin' is widely known. Fortinet recommends renaming the default account or disabling it and creating a new one with a unique name for daily use to prevent brute-force attacks.
Trusted hosts are IP addresses or networks from which a specific administrator is allowed to log in. You configure them in the administrator account settings under 'Trusted Hosts' by adding IP/network pairs. If the administrator's IP does not match, login is denied even with the correct password.
No, HTTP sends all data, including passwords, in plain text across the network. Anyone on the same network can capture your credentials using a packet sniffer. Always use HTTPS (encrypted) for web-based management, or SSH for command-line access.
The 'prof_admin' profile is a predefined administrative profile that provides read-write access to most system configuration settings except for system admin settings (like creating other administrators). It is useful for granting broad management rights without allowing the user to change administrator accounts.
You've finished System Administration and Management. Continue through the NSE4 study guide to build a complete picture of the exam.
Done with this chapter?