How to Enable SSH Management Access on a FortiGate Interface
A network administrator needs to allow SSH access to the FortiGate from a management subnet 10.0.1.0/24. Which configuration step is required on the interface connected to that subnet?
Quick Answer
The answer is to enable SSH administrative access on the interface connected to the management subnet. This is correct because FortiGate interfaces have a dedicated administrative access setting that controls which management protocols—such as SSH, HTTPS, or Ping—are allowed to reach the device itself at Layer 3, before any firewall policy is evaluated. Without this setting enabled, the FortiGate silently drops SSH packets at the interface level, regardless of any firewall rules that might otherwise permit traffic from the 10.0.1.0/24 subnet. On the Fortinet NSE 4 exam, this question tests your understanding of the distinction between interface-level administrative access and policy-based traffic control—a common trap is assuming a firewall policy alone is sufficient for management access. Remember the key rule: management access is controlled at the interface, not by policies. A helpful memory tip is “SSH needs the interface switch”—if you want SSH to reach the box, flip the toggle on the interface itself.
⚠ Common exam trap
It's easy for candidates to assume a firewall policy is sufficient to allow management traffic, forgetting that administrative access must be explicitly enabled on the interface for protocols like SSH, HTTPS, or Telnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable SSH administrative access on the interface
To allow SSH access to the FortiGate from a specific subnet, you must enable SSH administrative access on the interface connected to that subnet. This setting controls which management protocols are permitted to reach the FortiGate itself at the interface level, independent of firewall policies. Without enabling SSH on the interface, the FortiGate will drop SSH packets at Layer 3 before any policy lookup occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable HTTPS administrative access only
Why it's wrong here
HTTPS administrative access permits only the web GUI on port 443; it does not enable the SSH daemon, so SSH connections are refused. It is tempting because HTTPS is a standard management protocol, and enabling it alone would be correct if the requirement were browser-based administration rather than command-line SSH access.
- ✗
Set the administrative access to 'any'
Why it's wrong here
Setting administrative access to 'any' enables every protocol including Telnet and HTTP, exposing the management interface far beyond the SSH requirement. It is tempting as a quick way to guarantee SSH works, and it would be acceptable only in a lab where all management protocols on that interface are genuinely needed.
- ✓
Enable SSH administrative access on the interface
Why this is correct
SSH access terminates on the FortiGate interface facing the management subnet, so administrative access must be enabled per-protocol on that interface. Without SSH ticked under Administrative Access, the firewall silently drops inbound TCP 22 even if a permissive policy exists.
- ✗
Configure a firewall policy allowing SSH from the subnet
Why it's wrong here
A firewall policy controls traffic traversing the FortiGate, not traffic terminating on it; SSH to the device itself is governed by the interface's administrative access settings. It is tempting because policies normally permit access, and this would be correct for SSH passing through the FortiGate to a downstream server.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator needs to allow SSH management access from a specific IP address 10.0.0.100. Which configuration is required?
easy- A.Enable SSH on the WAN interface and allow all IPs
- ✓ B.Set the trusted host for the admin account to 10.0.0.100
- C.Configure an access list on the upstream router
- D.Create a firewall policy allowing SSH from 10.0.0.100 to the FortiGate
Why B: FortiGate uses the 'trusted host' feature to restrict administrative access to specific source IP addresses. By setting the trusted host to 10.0.0.100 for the admin account, only that IP can initiate SSH sessions to the FortiGate management interface, regardless of which interface SSH is enabled on.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.