FortiGate secure baseline: protect the firewall itself

A firewall protects the network, but it is also a target: several FortiOS vulnerabilities have been exploited in recent years, most often on devices whose management interface was reachable from the internet. These settings close the most common gaps.

Step 1. Personal administrators limited to trusted networks

Create named administrators with long unique passwords and trusted hosts — they can only log in from the listed networks. Then delete the default admin account. Enable two-factor authentication (FortiToken) for administrators where possible.

config system admin
    edit "netadmin"
        set accprofile "super_admin"
        set password "Long-Unique-Password"
        set trusthost1 192.168.1.0 255.255.255.0
    next
end
# log in as netadmin, then remove the default account:
config system admin
    delete "admin"
end

Step 2. No management on the internet port

Remove HTTPS, SSH and other management protocols from WAN interfaces. Manage the firewall only from the office network or through VPN.

config system interface
    edit "wan1"
        set allowaccess ping
    next
end

Step 3. Lockout and FortiCloud SSO

Lock out an address after repeated failed logins. If you do not use FortiCloud single sign-on for administrators, turn it off — it was the entry point of CVE-2026-24858.

config system global
    set admin-lockout-threshold 3
    set admin-lockout-duration 900
    set admin-forticloud-sso-login disable
end

Step 4. Keep FortiOS up to date

Check System → Firmware regularly and follow Fortinet PSIRT advisories. Use the recommended upgrade path between major versions, and update during a maintenance window. Treat critical SSL VPN and management flaws as emergencies.

Step 5. Back up the configuration and send logs out

Save the configuration after every change and keep copies off the device. Send logs to FortiAnalyzer or a syslog server so they survive a compromise.

execute backup config tftp fgt-backup.conf 192.168.1.10

The firewall must be the best-protected device in the network — not the one nobody has logged into for a year.

Need help with this? Contact CySec for a free consultation.

All articles