Safety tips for working with FortiGate

Last update: December 11 2025

Recommendations that will improve safety.

Use secure access protocols

Deny HTTP or Telnet administrative access to the FortiGate unit. We recommend leaving only HTTPS and SSH access.

Graphical interface

You can change these settings for individual interfaces on the Network → Interfaces tab.

CLI

To change via the CLI, enter:

    config system interface
        edit <interface_name>
          set allowaccess https ssh
    end

Enable redirection to HTTPS

Redirect all HTTP connection attempts to HTTPS.

Graphical interface

1. Go to System → Settings → Administrator Settings
2. Enable Redirect to HTTPS.

CLI

To change via the CLI, enter:

    config system global
        set admin-https-redirect enable
    end

Change the default access ports

Change the default ports for administrator access via HTTPS and SSH to non-standard ports. Before changing, make sure that the ports are not used for other services.

Graphical interface

1. Go to System → Settings → Administrator Settings
2. Change the HTTPS and SSH ports.

CLI

To change via the CLI, enter:

    config system global
        set admin-port 48008
        set admin-sport 48344
        set admin-ssh-port 48022
        set admin-telnet-port 48032
    end

Configure short entry timeouts

Set the idle time to a short time to avoid unauthorized access when the administrator is not present.

Graphical interface

1. Go to System → Settings.
2. Enter the Idle timeout value. The recommended time is five minutes.

CLI

You can use the following command to configure the grace time between SSH connection establishment and authentication. The range can be from 10 to 3600 seconds, with the default being 120 seconds. For example, you can set the time to 30 seconds:

    config system global
        set admin-ssh-grace-time 30
    end

Configure login for trusted addresses

Allow login only from trusted addresses.

Graphical interface

1. Go to System → Administrators.
2. Edit the account, enable Restrict login to trusted hosts.
3. Add trusted addresses or networks.

CLI

To change via the CLI, enter:

    config system admin
        edit admin
          set trustedhost1 <ip_address>/<mask>
    end

Create multiple administrator accounts

For security reasons, it is recommended to have a separate account for each administrator. Create multiple administrator accounts.

Configure account lockout

For password protection , set the account to lock after entering an incorrect password. The default number of failed password attempts is three.

Rename the administrator account

Rename the administrator account. This makes it more difficult for an attacker to log in to FortiOS.

Disable unused interfaces

Graphical interface

1. Go to Network → Interfaces.
2. Edit the interface and set Interface Status to Disabled.

CLI

To change via the CLI, enter:

    config system interface
        edit port2
          set status down
    end

Disable unused protocols

You can disable unused protocols that attackers can use to gather information. Many of these protocols are disabled by default.

CLI

To change via the CLI, enter:

    config system interface
        edit <interface_name>
          set dhcp-relay-service disable
          set pptp-client disable
          set arpforward disable
          set broadcast-forward disable
          set l2forward disable
          set icmp-redirect disable
          set vlanforward disable
          set stpforward disable
          set ident-accept disable
          set ipmac disable
          set netbios-forward disable
          set security-mode none
          set device-identification disable
          set lldp-transmission disable
    end