+372 53 888 229info@itabiks.ee

FortiGate first setup: a checklist for small offices

What to configure first on a new FortiGate and why: firmware, admin access, MFA, policies, security profiles, backups and logging, in a sensible order.

4 min

A new FortiGate gets traffic flowing quickly, but a firewall left on default settings is not yet secure. This checklist is written for a small office and follows the order in which it makes sense to work: first protect the device itself, then the network, and finally make sure the configuration cannot be lost.

1. Firmware and registration

  1. Check the firmware version. Dashboard → Status shows the current FortiOS version; in the CLI, get system status gives the same information. A unit that has sat in a warehouse may run an old version with known vulnerabilities. Upgrade before the device goes live, when an outage bothers nobody.
  2. Register the device. Add the serial number to your Fortinet support portal account. Without registration, FortiCare support and FortiGuard services are not activated. You can see the status under System → FortiGuard.

2. Harden admin access

This is the most important step: a firewall whose management interface is reachable from the internet is the first thing attackers go for.

  • Create a named administrator account (System → Administrators) with a strong password. Do not use the default admin account day to day: give it a very long password, or rename it if your processes allow.
  • Trusted Hosts. In the administrator settings, restrict which IP addresses or subnets may log in with that account, for example only the office LAN.
  • Multi-factor authentication (MFA). Add FortiToken to administrators (User & Authentication → FortiTokens). Some models come with a couple of free FortiToken Mobile licences.
  • Disable management on the WAN. Network → Interfaces → WAN interface → Administrative Access: untick HTTPS, HTTP, SSH and, if not needed, PING. For remote management use a VPN, not a public admin page.

3. Interfaces, DHCP, DNS and time

  • Interfaces and DHCP. Set the LAN interface IP address and DHCP server. Decide early whether guests, printers or cameras need a separate network (VLAN); it is harder to change later.
  • Avoid common subnets. If the office network is 192.168.1.0/24, it overlaps with many home routers and will cause VPN problems later. Pick a less common range.
  • DNS. Network → DNS: use FortiGuard or your preferred DNS servers. If the office has a domain controller, hand out its address to clients via DHCP.
  • Time and time zone. System → Settings: set the time zone and enable NTP synchronisation. A wrong clock breaks log timelines, certificate checks and FortiToken codes.

4. Firewall policies and security profiles

Policy & Objects → Firewall Policy. The principle is least privilege: allow only what is needed, and everything else stays denied by default.

  • Do not create an "any to any, all services" rule. Separate the internal network, guest network and servers, and allow only the connections that are needed between them.
  • Open inbound connections (port forwarding, Virtual IPs) only when truly required, and restrict them by source IP where possible.
  • Apply security profiles to outbound policies: AntiVirus, Web Filter, IPS and Application Control. Start with the default profiles and tune them later.
  • Enable logging on every policy (Log Allowed Traffic) so you can see later what happened.

5. Logging and backup

  • Logging. Log & Report → Log Settings. Smaller models have limited or no local log storage. Consider sending logs to FortiAnalyzer, FortiAnalyzer Cloud or a syslog server so you have history when an incident happens.
  • Backup. Once configured, back up the configuration (admin menu top right → Configuration → Backup) and store it securely outside the firewall. If you encrypt the backup, keep the password in a password manager. Take a new backup after every significant change.
  • Document it. Write down IP ranges, administrators, open ports and licence expiry dates.

When to call a professional

If you have several sites, remote workers, VLANs or services that must be published to the internet, it is worth having an experienced network engineer do the initial setup, because mistakes are harder to spot than to avoid. ITABIKS configures FortiGate firewalls every day; see network device setup or call +372 53 888 229.

Was this article helpful?