Techzone/FortiGate Firewall

FortiGate Firewall

3 min readArticle

FortiGate is Fortinet's next-generation firewall (NGFW) product line. It's one of the most widely deployed enterprise firewalls. FortiGate runs FortiOS and offers stateful firewall, IPS, application control, web filtering, SSL inspection, and VPN all in one appliance. A competitor to Cisco ASA/FTD, Palo Alto, and Check Point.

FortiOS CLI Basics

bash 
# Access CLI via SSH or console
ssh [email protected]

# Check firmware version
get system status

# Show interfaces
show system interface

# Show routing table
get router info routing-table all

# Show active sessions
get system session list

# Show CPU/memory
get system performance status

Key Configuration Areas

Interfaces

bash 
# Show interface config
show system interface

# Configure an interface
config system interface
    edit "wan1"
        set mode dhcp
        set allowaccess ping https ssh
    next
end

Firewall Policies

bash 
# Show all firewall policies
show firewall policy

# Show policy with IDs
get firewall policy

# Create a policy (allow LAN to WAN)
config firewall policy
    edit 0
        set name "LAN-to-WAN"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
        set logtraffic all
    next
end

VPN Configuration

bash 
# Check IPsec VPN tunnels
get vpn ipsec tunnel summary

# Check SSL-VPN users
get vpn ssl monitor

# Show VPN config
show vpn ipsec phase1-interface
show vpn ipsec phase2-interface

Addresses and Objects

bash 
# Show address objects
show firewall address

# Create an address object
config firewall address
    edit "Server-192.168.1.100"
        set subnet 192.168.1.100 255.255.255.255
    next
end

Logging and Monitoring

bash 
# Show logs (local)
execute log filter category traffic
execute log display

# Real-time traffic monitoring
diag sniffer packet any "host 192.168.1.1" 4

# Real-time debug (verbose)
diag debug enable
diag debug flow filter addr 192.168.1.1
diag debug flow show function-name enable
diag debug flow trace start 100

# Stop debug
diag debug disable
diag debug reset

Packet Sniffer (Built-in)

bash 
# Capture traffic on interface
diag sniffer packet wan1 "tcp port 443" 4 0

# Format: diag sniffer packet <interface> '<filter>' <detail> <count>
# Detail levels: 1=header, 2=header+hex, 3=header+hex+data, 4=header+payload

Security Assessment Notes

FortiGate CVEs to Know

  • CVE-2022-40684 (Auth bypass, CVSS 9.8) — unauthenticated admin access via API
  • CVE-2023-27997 (Heap overflow in SSL-VPN, CVSS 9.8) — pre-auth RCE
  • Multiple SSL-VPN vulnerabilities — FortiGate SSL-VPN has been a persistent target

FortiGate is heavily targeted by ransomware groups and nation-state actors. Patching is critical.

Check for Exposed Management

bash 
# Check if HTTPS admin is internet-facing
curl -k https://fortigate-ip/

# Check SSL-VPN portal
curl -k https://fortigate-ip:443/

# Look for FortiGate in Shodan
# Search: "server: xxxxxxxx-xxxxx" or "FortiGate" in SSL cert

Default Credentials

  • Default: admin / (no password)
  • Should be changed immediately

FortiGate HA (High Availability)

bash 
# Check HA status
get system ha status

# Show HA peers
diagnose sys ha showcsum

FortiManager / FortiAnalyzer

  • FortiManager — centralized management for multiple FortiGates
  • FortiAnalyzer — centralized logging and reporting
  • Both can be targeted in attacks as they have admin access to all managed devices

See Also

  • cisco-networking-guide - Cisco networking
  • networking/index - Networking overview
techzonesite.comUnlock Your IT Potential