1.1 Basic Settings

Explore the CLI

To explore the CLI, from the GNS3 double click on FortiGate to open the console. In the Password field, type <the default password is blank>, and then press enter.

Enter the following command:

This command displays basic status information about FortiGate. The output includes FortiGate’s serial number, operation mode, and a lot of useful information. When the More prompt appears on the CLI, do one of the following:

• To continue scrolling, Space bar.
• To scroll one line at a time, Enter.
• Enter the following command: get ?

This command shows all of the options that the CLI will accept after the # get command. Depending on the command, you may need to enter additional words to completely specify a configuration option.

• Enter the following command: execute ?
• This command lists all options that the CLI will accept after the execute command.
• Type exe, and then press the Tab key. Notice that the CLI completes the current word.
• Press the space bar and then press the Tab key three times.
• Each time you press the Tab key, the CLI replaces the second word with the next possible option for the execute command, in alphabetical order.

Configuration

Network

Hardware

High Availability (HA)

Network Time Protocol (NTP)

Table 1.5: NTP CLI

Action	Command
Check NTP	# execute time # get system ntp # diagnose sys ntp status

On a fresh line, enter the following command to view the port3 interface configuration:

show system interface port3

Enter the following command:

show full-configuration system interface port3

Enter the following command:

show system interface

For setting an IP address on the port1:

config system interface
edit port1
set mode static
set ip 192.168.10.1 255.255.255.0
set allowaccess ping ssh http https
end

Now you should be able to reach the firewall from port1. In browser, type http://192.168.10.1 and enter username and password.

In the licensed devices, you should type https://192.168.10.1 and then enter username and password.

Configuring Administrator Accounts

FortiGate offers many options for configuring administrator privileges. For example, you can specify the IP addresses that administrators are allowed to connect from. In this exercise, you will work with administrator profiles and administrator user accounts. An administrator profile is a role that is assigned to an administrator user that defines what the user is permitted to do on the FortiGate GUI and CLI.

Configure a User Administrator Profile

1. Click System > Admin Profiles.
2. Click Create New.
3. In the Name field, type Security_Admin_Profile.
4. In the permissions table, set Security Profile to Read-Write, but set all other permissions to Read.
5. Click OK to save the changes.

Create an Administrator Account

Now, you will create a new administrator account. You will assign the account to the administrator profile you created previously. The administrator will have read-only access to most of the configuration settings. To create an administrator account Continuing on the Local-FortiGate GUI, click System > Administrators. Click Create New and then click Administrator to add a new administrator account and assign the previous profile you have created to the administrator.

Test the New Administrator Account

In this procedure, you will confirm that the new administrator account has read-write access to only the security profiles configuration.

To test the new administrator account Continuing on the Local-FortiGate GUI, click username (in my case, it’s admin2) and then Logout to log out of the admin account’s GUI session.

Explore the permissions that you have in the GUI. You should see that this account can configure only security profiles. Log out of the GUI once done.

Restrict Administrator Access

Now, you will restrict access for FortiGate administrators. Only administrators connecting from a trusted subnet will be allowed access. This is useful if you need to restrict the access points from which administrators connect to FortiGate. To restrict administrator access.

1. Click System > Administrators. Edit the admin account.
2. Enable Restrict login to trusted hosts, and set Trusted Host 1 to the address
   192.168.10.100/32.
3. Click OK to save the changes.

To test the restricted access

1. Continuing on Local-Windows, log out of the Local-FortiGate GUI session as the admin user.
2. Try to log in to the admin2 account again with password < Your password>. Because you are trying to connect from the 192.168.10.101 address, you shouldn’t be able to connect.
3. Log in as admin with password <Your password>. Enter the following CLI commands to add 192.168.10.101/32 as the second trusted IP subnet (Trusted Host 2) to the admin account:
   config system admin
   edit admin
   set trusthost2 192.168.10.101/32
   end
4. Try to log in to the Local-FortiGate GUI at <IP address> with the username admin and password <Your password>. You should be able to log in. (Hint: add the IP address 192.168.10.101 to WebTerm and try to reach to the firewall.)

Configuration Backups

The configuration files produced by backups allow you to restore to an earlier FortiGate configuration.

Backup & Restore

Always back up the configuration file before making changes to FortiGate (even if the change seems minor or unimportant). There is no undo. You should carefully consider the pros and cons of an encrypted backup before you begin encrypting backups. While your configuration, including things like private keys, remains private, an encrypted file hampers troubleshooting because Fortinet support cannot read the file. Consider saving backups in plain-text and storing them in a secure place instead. Now, you will create an encrypted file with the backup of the FortiGate’s current configuration.

To save an encrypted configuration backup

Continuing on the Local-FortiGate GUI, in the upper-right corner, click admin, and then click Configuration > Backup. On the Backup System Configuration page, enable Encryption. In the Password field, enter fortigate and repeat in the Confirm password field.

Click OK.

Select Save File and click OK.

To restore an encrypted configuration backup

Continuing on the Local-FortiGate GUI, in the upper-right corner, click admin, and then click Configuration > Restore. On the Restore System Configuration page, click Upload. Browse to your Downloads folder and select the configuration file that you created in the previous procedure. In the Password field, type fortigate, and then click OK.

DHCP (Dynamic Host Configuration Protocol)

You can configure one or more DHCP servers on any FortiGate interface. A DHCP server dynamically assigns IP addresses to hosts on the network connected to the interface. The host computers must be configured to obtain their IP addresses using DHCP.

Configure DHCP on the FortiGate

To add a DHCP server on the GUI:

1. Go to Network > Interfaces.
2. Edit an interface.
3. Enable the DHCP Server option and configure the settings.

To do it through command line, use following commands:

Resources

• Fortinet Fortigate CLI Commands
• FortiGate document library