Sign in to the FortiGate

Sign in to the FortiGate’s screen, where you set the firewall’s policies, routes, NAT, VPN tunnels, and admin users. MyAccount is where you start, power off, and upgrade the firewall; everything inside the FortiGate is set here, or on its command line.

Before you begin

• The firewall shows Running on Manage Firewall. See Create a firewall. On a new firewall, the FortiGate’s screen opens about two minutes after the firewall first reads Running.
• You have the launch email. When a new firewall first runs, E2E emails its sign-in details to the person who created it, with the account owner copied. Its subject is Congratulations on launching Fortinet Firewall Appliance.
• The email’s password link is less than seven days old.

Get the password

The launch email gives the firewall’s name, its public and private IPs, and:

• Username : admin
• Password, as a link. Open it to see the password on a MyAccount page.
• URL: https://, the address of the FortiGate’s screen.

Open the password link and copy the password.

Sign in

1. In a browser, go to https://<public-ip>, where <public-ip> is the firewall’s public IP. It is in the email, under Public IP on Manage Firewall, and under Public IPv4 on the firewall’s Network tab.
2. Sign in with the username admin and the password from the email.

The FortiGate’s screen opens. The address starts with https://, not http://. For help when the page does not open or the password is refused, see I cannot reach the FortiGate’s screen at its public IP.

The same username and password also open the FortiGate’s command line over SSH, on port 22 of the public IP:

ssh admin@<public-ip>

Change the admin password once you are in, and keep the new one safe. If you later reinstall the firewall, the admin password goes back to the one from the launch email.

What is already set

The FortiGate starts with both of its addresses set:

• port1 carries its public IP, the reserved IP you picked when you created it.
• port2 carries its address in the VPC you picked when you created it.

To add more VPCs, see Attach a VPC to a firewall.

Its licence is already loaded. To check it, open System > FortiGate VM License on the screen, or run this on the command line and read its License Status line:

get system status

A valid licence reads Valid, with an expiry date. If it reports the licence as invalid or expired, see The FortiGate shows its licence as invalid or expired.

Send a node’s traffic through the firewall

A node in the same VPC sends its traffic through the firewall once it has a route to the firewall’s private IP. On a Linux node, add the route with:

sudo ip route add <remote-range> via <firewall-private-ip> dev <interface>

• <remote-range> is the network the traffic is for, such as the address range at the other end of a VPN tunnel.
• <firewall-private-ip> is the firewall’s address in the VPC, under Private IP on Manage Firewall.
• <interface> is the node’s network interface in that VPC.

On a Windows node, add the route in PowerShell or a Command Prompt opened as administrator:

route -p add <remote-range> mask <netmask> <firewall-private-ip>

• <remote-range> is the start address of the same range as on Linux, without the / part, such as 203.0.113.0 for 203.0.113.0/24.
• <netmask> is that range’s mask, such as 255.255.255.0 for a /24 range.
• -p keeps the route after the node restarts.

Then allow that traffic with a policy on the FortiGate.

Before you build an IPsec VPN on the same address

The FortiGate’s screen uses port 443, and an IPsec VPN on the same public IP uses it too. Once the tunnel is in place, the screen can stop opening on 443. Move the screen to port 444 before you build the tunnel. On the FortiGate’s command line, run:

config system global
set admin-sport 444
end

From then on, open the screen at https://<public-ip>:444. You can also change the port on the screen, under System > Settings, as Set up a site-to-site VPN to Google Cloud shows.

To build the tunnel, see Set up a site-to-site VPN to AWS, Set up a site-to-site VPN to Google Cloud, or Connect two firewalls with an IPsec VPN.

For everything you set on the FortiGate itself, see Fortinet’s FortiGate documentation. For a second way in, from inside MyAccount, ask support to turn on console access. See Open the firewall console.