---
title: "Security best practices for FortiGate"
sidebar_label: "Security best practices for FortiGate"
sidebar_position: 2
description: "How to improve account security level"
---

import Formbricks from '@theme/MDXComponents/Formbricks';

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
import { TabItemLabel } from '@selectel/docux/components';

# Security best practices for FortiGate

Recommendations for improving your security level.

The settings in this guide are valid for FortiOS 6.x and 7.x versions. If you have a different version of FortiOS, you can find documentation for it in the FortiGate control panel in the top-right corner or on the [official FortiGate website](https://docs.fortinet.com).

## Use secure access protocols \{#use-secure-access-protocols}

Disable HTTP or Telnet for administrative access to FortiGate. We recommend leaving only HTTPS and SSH access enabled.

<Tabs queryString="use-secure-access-protocols">
  <TabItem value="graphic" default>
    <TabItemLabel>
      Graphical interface
    </TabItemLabel>

    You can change these settings for individual interfaces on the **Network** → **Interfaces** tab.
  </TabItem>

  <TabItem value="cli">
    <TabItemLabel>
      CLI
    </TabItemLabel>

    To change via CLI, enter:

    ```bash
        config system interface
            edit <interface_name>
              set allowaccess https ssh
        end
    ```
  </TabItem>
</Tabs>

## Enable redirect to HTTPS \{#enable-redirect-to-https}

Redirect all HTTP connection attempts to HTTPS.

<Tabs queryString="enable-redirect-to-https">
  <TabItem value="graphic" default>
    <TabItemLabel>
      Graphical interface
    </TabItemLabel>

    1. Go to **System** → **Settings** → **Administrator Settings**
    2. Enable **Redirect to HTTPS**.
  </TabItem>

  <TabItem value="cli">
    <TabItemLabel>
      CLI
    </TabItemLabel>

    To change via CLI, enter:

    ```bash
        config system global
            set admin-https-redirect enable
        end
    ```
  </TabItem>
</Tabs>

## Change default access ports \{#change-default-access-ports}

Change the default ports for administrative access via HTTPS and SSH to non-standard ones. Before changing, ensure that the ports are not used for other services.

<Tabs queryString="change-default-access-ports">
  <TabItem value="graphic" default>
    <TabItemLabel>
      Graphical interface
    </TabItemLabel>

    1. Go to **System** → **Settings** → **Administrator Settings**
    2. Change the HTTPS and SSH ports.
  </TabItem>

  <TabItem value="cli">
    <TabItemLabel>
      CLI
    </TabItemLabel>

    To change via CLI, enter:

    ```bash
        config system global
            set admin-sport 48344
            set admin-ssh-port 48022
        end
    ```
  </TabItem>
</Tabs>

## Configure short login timeouts \{#configure-short-login-timeouts}

Set the idle time to a short duration to prevent unauthorized access when the administrator is absent.

<Tabs queryString="configure-short-login-timeouts">
  <TabItem value="graphic" default>
    <TabItemLabel>
      Graphical interface
    </TabItemLabel>

    <Tabs queryString="firmware">
      <TabItem value="fortios-6" default>
        <TabItemLabel>
          FortiOS 6.x
        </TabItemLabel>

        1. Go to **System** → **Settings**.
        2. In the **Idle timeout** field, specify the idle time in minutes. The recommended time is five minutes.
        3. Click **Apply**.
      </TabItem>

      <TabItem value="fortios-7-6">
        <TabItemLabel>
          FortiOS 7.x
        </TabItemLabel>

        1. Go to **System** → **Settings**.
        2. In the **Admimistration settings** → **Idle timeout** block, specify the idle time in minutes. The recommended time is five minutes.
        3. Click **Apply**.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="cli">
    <TabItemLabel>
      CLI
    </TabItemLabel>

    <Tabs queryString="firmware">
      <TabItem value="fortios-6" default>
        <TabItemLabel>
          FortiOS 6.x
        </TabItemLabel>

        You can configure the timeout between an established SSH connection and authentication. The default value is 120 seconds.

        ```bash
         config system global
             set admin-ssh-grace-time <grace_time>
         end
        ```

        Specify `<grace_time>` — the numerical timeout value between an established SSH connection and authentication. The minimum value in seconds is 10, the maximum is 3600.
      </TabItem>

      <TabItem value="fortios-7-6">
        <TabItemLabel>
          FortiOS 7.x
        </TabItemLabel>

        ```bash
        config system global
            set admintimeout <administrator_timeout>
        end
        ```

        Specify `<administrator_timeout>` — the numerical idle time value. The minimum value in minutes is 1, the maximum is 480.
      </TabItem>
    </Tabs>
  </TabItem>
</Tabs>

## Configure login for trusted addresses \{#configure-login-for-trusted-addresses}

Allow login only from trusted addresses.

<Tabs queryString="configure-login-for-trusted-addresses">
  <TabItem value="graphic" default>
    <TabItemLabel>
      Graphical interface
    </TabItemLabel>

    1. Go to **System** → **Administrators**.
    2. Edit the account, enable **Restrict login to trusted hosts**.
    3. Add trusted addresses or networks.
  </TabItem>

  <TabItem value="cli">
    <TabItemLabel>
      CLI
    </TabItemLabel>

    To change via CLI, enter:

    ```bash
        config system admin
            edit admin
              set trustedhost1 <ip_address>/<mask>
        end
    ```
  </TabItem>
</Tabs>

## Create multiple administrator accounts \{#create-several-administrator-accounts}

For security purposes, it is recommended to have a separate account for each administrator. [Create multiple administrator accounts](/firewalls/fortigate/manage-account.mdx#create-administrator-account).

## Configure account lockout \{#configure-account-lockout}

To protect against password brute-forcing, [configure account lockout after incorrect password entry](/firewalls/fortigate/manage-account.mdx#configure-account-lockout). By default, the number of failed password entry attempts is three.

## Rename the administrator account \{#rename-administrator-account}

[Rename the administrator account](/firewalls/fortigate/manage-account.mdx#rename-account). This makes it more difficult for an attacker to log in to FortiOS.

## Disable unused interfaces \{#disable-unused-interfaces}

<Tabs queryString="disable-unused-interfaces">
  <TabItem value="graphic" default>
    <TabItemLabel>
      Graphical interface
    </TabItemLabel>

    1. Go to **Network** → **Interfaces**.
    2. Edit the interface and set the **Interface Status** parameter to **Disabled**.
  </TabItem>

  <TabItem value="cli">
    <TabItemLabel>
      CLI
    </TabItemLabel>

    To change via CLI, enter:

    ```bash
        config system interface
            edit port2
              set status down
        end
    ```
  </TabItem>
</Tabs>

## Disable unused protocols \{#disable-unused-protocols}

You can disable unused protocols that attackers might use for information gathering. Many of these protocols are disabled by default.

<Tabs queryString="disable-unused-protocols">
  <TabItem value="cli" default>
    <TabItemLabel>
      CLI
    </TabItemLabel>

    To change via CLI, enter:

    ```bash
        config system interface
            edit <interface_name>
              set dhcp-relay-service disable
              set pptp-client disable
              set arpforward disable
              set broadcast-forward disable
              set l2forward disable
              set icmp-redirect disable
              set vlanforward disable
              set stpforward disable
              set ident-accept disable
              set ipmac disable
              set netbios-forward disable
              set security-mode none
              set device-identification disable
              set lldp-transmission disable
        end
    ```
  </TabItem>
</Tabs>

<Formbricks />