--- title: "Sign in to the FortiGate" description: "Sign in to your E2E Firewall's FortiGate at its public IP as admin, with the password from the launch email, and send a node's traffic through it." content_type: "how-to" product: "firewall" platform: "MyAccount" url: "/myaccount/firewall/how-to/sign-in-to-the-fortigate/" topic: ["create"] relationships: {"requires":["/myaccount/firewall/how-to/create-a-firewall/"]} --- # Sign in to the FortiGate Sign in to the FortiGate's screen, where you set the firewall's policies, routes, NAT, VPN tunnels, and admin users. MyAccount is where you start, power off, and upgrade the firewall; everything inside the FortiGate is set here, or on its command line. ## Before you begin - The firewall shows **Running** on **Manage Firewall**. See [Create a firewall](/myaccount/firewall/how-to/create-a-firewall/). On a new firewall, the FortiGate's screen opens about two minutes after the firewall first reads **Running**. - You have the launch email. When a new firewall first runs, E2E emails its sign-in details to the person who created it, with the account owner copied. Its subject is **Congratulations on launching Fortinet Firewall Appliance**. - The email's password link is less than seven days old. ## Get the password The launch email gives the firewall's name, its public and private IPs, and: - **Username : admin** - **Password**, as a link. Open it to see the password on a MyAccount page. - **URL: https://**, the address of the FortiGate's screen. Open the password link and copy the password. ## Sign in 1. In a browser, go to `https://`, where `` is the firewall's public IP. It is in the email, under **Public IP** on **Manage Firewall**, and under **Public IPv4** on the firewall's **Network** tab. 2. Sign in with the username `admin` and the password from the email. The FortiGate's screen opens. The address starts with `https://`, not `http://`. For help when the page does not open or the password is refused, see [I cannot reach the FortiGate's screen at its public IP](/myaccount/firewall/troubleshooting/firewall/#i-cannot-reach-the-fortigates-screen-at-its-public-ip). The same username and password also open the FortiGate's command line over SSH, on port 22 of the public IP: ```bash ssh admin@ ``` Change the `admin` password once you are in, and keep the new one safe. If you later reinstall the firewall, the `admin` password goes back to the one from the launch email. ## What is already set The FortiGate starts with both of its addresses set: - `port1` carries its public IP, the reserved IP you picked when you created it. - `port2` carries its address in the VPC you picked when you created it. To add more VPCs, see [Attach a VPC to a firewall](/myaccount/firewall/how-to/attach-a-vpc-to-a-firewall/). Its licence is already loaded. To check it, open **System** > **FortiGate VM License** on the screen, or run this on the command line and read its **License Status** line: ```text get system status ``` A valid licence reads **Valid**, with an expiry date. If it reports the licence as invalid or expired, see [The FortiGate shows its licence as invalid or expired](/myaccount/firewall/troubleshooting/firewall/#the-fortigate-shows-its-licence-as-invalid-or-expired). ## Send a node's traffic through the firewall A node in the same VPC sends its traffic through the firewall once it has a route to the firewall's private IP. On a Linux node, add the route with: ```bash sudo ip route add via dev ``` - `` is the network the traffic is for, such as the address range at the other end of a VPN tunnel. - `` is the firewall's address in the VPC, under **Private IP** on **Manage Firewall**. - `` is the node's network interface in that VPC. On a Windows node, add the route in PowerShell or a Command Prompt opened as administrator: ```powershell route -p add mask ``` - `` is the start address of the same range as on Linux, without the `/` part, such as `203.0.113.0` for `203.0.113.0/24`. - `` is that range's mask, such as `255.255.255.0` for a `/24` range. - `-p` keeps the route after the node restarts. Then allow that traffic with a policy on the FortiGate. ## Before you build an IPsec VPN on the same address The FortiGate's screen uses port 443, and an IPsec VPN on the same public IP uses it too. Once the tunnel is in place, the screen can stop opening on 443. Move the screen to port 444 before you build the tunnel. On the FortiGate's command line, run: ```text config system global set admin-sport 444 end ``` From then on, open the screen at `https://:444`. You can also change the port on the screen, under **System** > **Settings**, as [Set up a site-to-site VPN to Google Cloud](/myaccount/firewall/how-to/set-up-a-site-to-site-vpn-to-google-cloud/#move-the-fortigates-screen-to-port-444) shows. To build the tunnel, see [Set up a site-to-site VPN to AWS](/myaccount/firewall/how-to/set-up-a-site-to-site-vpn-to-aws/), [Set up a site-to-site VPN to Google Cloud](/myaccount/firewall/how-to/set-up-a-site-to-site-vpn-to-google-cloud/), or [Connect two firewalls with an IPsec VPN](/myaccount/firewall/how-to/connect-two-firewalls-with-an-ipsec-vpn/). For everything you set on the FortiGate itself, see Fortinet's [FortiGate documentation](https://docs.fortinet.com/product/fortigate). For a second way in, from inside MyAccount, ask support to turn on console access. See [Open the firewall console](/myaccount/firewall/how-to/open-the-firewall-console/).