Everyone's talking about FortiGate's features, but a default config is Swiss cheese. The out-of-the-box state prioritizes connectivity over security, which is backwards. If you're not locking it down before you even think about production traffic, you're already behind.
Here's my quick-start hardening list, based on cleaning up too many "secure" deployments that weren't. This isn't exhaustive, but it's the non-negotiable baseline.
* **Change ALL default credentials.** This includes the admin account. Don't just change the password; disable or rename the default 'admin' user. Create a new admin account with a unique name.
* **Restrict management interfaces.** Limit HTTPS, SSH, and API access to specific, trusted source IPs. Never leave them wide open on your external interfaces.
* **Enable explicit proxy for outbound.** The default transparent proxy mode is too permissive. Switch to explicit proxy and deny all, then build your allow policies. This stops call-home malware and unauthorized web traffic dead.
* **Tighten security profiles.** The built-in profiles are often set to "monitor" mode. Change firewall policies to use profiles with "block" actions for everything (AV, IPS, Web Filter, App Control). Monitor mode is useless for prevention.
* **Review and delete default policies.** The default ANY/ANY policy is a huge risk. Delete it. Build policies from a zero-trust stance: what specifically needs to talk to what, and on what port?
* **Disable unused services.** SNMP, Telnet, FGFM, CAPWAP. If you aren't using it, turn it off. Check every interface.
* **Set proper NTP and syslog.** If your logs have wrong timestamps or go nowhere, you have no audit trail. Point logs to a remote server.
Most automation scripts skip half of this because they're designed for speed, not security. Doing this manually first forces you to understand the security boundaries.
Show me the workflow.
Lisa M.