FortinetConfig1,234 downloads

Fortinet FortiGate Base / Day-0 Config

Day-zero configuration for FortiGate firewalls: hostname, admin, NTP, DNS, management interface, and FortiGuard settings via FortiOS CLI.

↓ example.txt

What is it?

The FortiGate base config establishes the foundation every FortiOS deployment needs: hostname, admin credentials, DNS, NTP, and management interface access. FortiOS uses a hierarchical CLI with 'config / edit / set / next / end' blocks — different from Cisco's flat IOS syntax. Every FortiGate should have NTP configured first because log timestamps, certificate validity, and HA timing all depend on accurate time. The management interface should be on a dedicated out-of-band network separate from production traffic.

When to use

·First-time setup of any FortiGate appliance or VM
·Replacing a failed unit — apply base config before restoring the full backup
·Standardizing Day-0 config across multiple FortiGate deployments

When NOT to use

·This is a prerequisite, not an optional step — every FortiGate deployment needs a base config before anything else

How it compares

vs Palo Alto base-configBoth cover the same Day-0 essentials. FortiOS uses 'config system global' blocks; PAN-OS uses 'set deviceconfig system' commands. FortiGate integrates FortiGuard cloud services natively (AV, IPS, URL filtering subscriptions).

vs Cisco IOS base-configIOS uses line-by-line commands; FortiOS uses structured config blocks. FortiGate lacks a 'running-config' concept — changes take effect immediately without an explicit commit (unlike PAN-OS).

Prerequisites

→Physical or console access to complete initial setup
→Management IP, subnet mask, and default gateway decided before starting
→NTP server IPs available (use pool.ntp.org if no internal NTP)
→Admin password complexity requirements reviewed

Config Generator

Hostname *

Timezone ID

4=US/Eastern, 12=UTC, 25=US/Pacific. See FortiOS TZ table.

Admin Password *

Management Interface

Management IP *

Management Netmask *

Management Gateway *

Primary DNS

Secondary DNS

Primary NTP

Secondary NTP

Enable FortiCloud?

Additional Admin Users

Verification commands

get system status

Verify hostname, firmware version, and system uptime

ExpectedShows hostname, FortiOS version, serial number, and operation mode

get system ntp

Verify NTP sync status

ExpectedShows NTP server IPs and 'synchronized: yes'. If 'no', time sync is failing.

get router info routing-table all

Verify default route via management interface is installed

ExpectedShows 'S* 0.0.0.0/0' with the management gateway as next-hop

Debug commands

diagnose sys ntp status

Show detailed NTP synchronization state

Common mistakes & fixes

SymptomCannot SSH to management interface

CauseSSH not in 'allowaccess' on the management interface

Fixconfig system interface > edit <mgmt-if> > set allowaccess ping https ssh > next > end

SymptomNTP not synchronizing

CauseDNS not configured (NTP hostname can't resolve) or UDP 123 blocked

FixVerify DNS: 'get system dns'. Use IP addresses for NTP servers instead of hostnames. Check if firewall policy allows UDP 123 from management interface.

SymptomLost admin access after changing trusted hosts

CauseWorkstation IP not included in trusthost entries

FixUse console access. 'config system admin > edit admin > unset trusthost1 > end'. Re-add with correct subnet.

Further learning

Recommended books to go deeper on this topic.

CCNA 200-301 Official Cert Guide Library

Wendell Odom · Cisco Press · Best starting point for Cisco IOS fundamentals — CLI, interfaces, basic routing

Kindle ↗Hardcover ↗

CCNP Enterprise Core ENCOR 350-401 Official Cert Guide

Brad Edgeworth et al. · Cisco Press · For engineers ready to go deeper — routing, switching, security, automation