How to Restrict FortiGate Admin Access to a Specific Management Subnet
A network administrator needs to configure a FortiGate to allow administrative access from a specific management subnet only. Which configuration step should be taken?
Quick Answer
The answer is to restrict administrative access to trusted hosts under System > Admin > Settings. This is correct because the Trusted Hosts feature explicitly filters inbound management sessions—such as HTTPS, SSH, and Telnet—by source IP address or subnet, ensuring only traffic from the specified management subnet can reach the FortiGate’s administrative interfaces. On the Fortinet NSE 4 exam, this concept tests your understanding of access control at the management plane, often appearing in scenario-based questions where you must differentiate between trusted hosts and interface-level policies; a common trap is confusing trusted hosts with firewall policies, which control data traffic rather than administrative access. Remember the memory tip: “Trusted hosts lock the admin door, not the data floor.”
⚠ Common exam trap
Many candidates confuse local-in policies with trusted hosts, thinking that a local-in policy is the primary method for restricting management access, when in fact trusted hosts is the simpler and correct approach for source-based restriction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Under system > admin > settings, restrict administrative access to trusted hosts.
The 'Trusted Hosts' feature under System > Admin > Settings allows you to restrict administrative access (HTTPS, SSH, Telnet, etc.) to specific source IP addresses or subnets. This is the intended method for limiting management access to a management subnet without affecting other traffic or interface configurations.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to ensure that administrative access to FortiGate is only allowed from the internal trusted network (192.168.1.0/24) and that all other access attempts are blocked. Which CLI command should the administrator configure first?
medium- ✓ A.config system admin; edit admin; set trusthost 192.168.1.0 255.255.255.0; end
- B.config system interface; edit port1; set allowaccess ping https ssh; end
- C.config system global; set admin-http-redirect enable; end
- D.set admin-sport 443
Why A: The `config system admin` command with `set trusthost` restricts administrative login attempts to only the specified source IP address or subnet. By setting `trusthost 192.168.1.0 255.255.255.0`, the FortiGate will only allow admin access from the 192.168.1.0/24 network, blocking all other sources. This is the foundational step to enforce source-based access control for administrative interfaces.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.