Fortinet · FortiOS 7.4 · Lesson 2 of 12

First day: interfaces and zones before the first policy

The box has a default password and a WAN DHCP address. Do not write policy yet. Name the interfaces, put them in zones if you will reuse them, lock admin to HTTPS + trusted host, set DNS and NTP. Policy on a nameless port is how juniors get lost in week three.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Set WAN, LAN, addressing, and a zone.
Restrict admin (HTTPS, trusted host) and change the default password.
Prove DNS and NTP before UTM or VPN.
Not create a LAN-to-WAN allow-all as “temporary.”

The ticket

Junior built 40 policies on port1 / port2. Hardware swap changes the port map. Every policy is now wrong. Zones would have survived.

Quick interview answer

First day is Network → Interfaces (addressing, role WAN/LAN, allow-access), optional Network → Zones so policy uses LAN not port2, then System → Settings / Administrators (HTTPS, trusted hosts), Network → DNS and NTP. FortiOS 7.4 Admin Guide: interface role and allowaccess are first-class fields. Never leave HTTP + ping open on WAN.

FortiGate first-day interface and zone setup — Name the cable before you write the rule.

Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

Interface = a cable + IP + allowaccess.
Zone = a bucket of interfaces you use in policy (LAN, WAN, DMZ).
Role in 7.4 (LAN/WAN/DMZ/undefined) drives GUI hints, not security by itself.

https://fgt-hq.techclick-lab.in

Training mock · not live

Admin

DashboardPolicyVPNNetwork

Network → Interfaces

Edit interface port2 (LAN)

Alias

LAN

Addressing mode

Manual 10.20.30.1/24

Role

LAN

Administrative access

HTTPS, SSH, PING (LAN only)

Zone

LAN

FortiOS 7.4 Network → Interfaces. Training mock.

How to choose

Choice	Use	Skip when
Policy on raw ports	Tiny lab, one cable forever	Any HA or hardware refresh
Zones	This class + production	You enjoy rewriting 80 policies
Allowaccess HTTPS on WAN	Break-glass with trusted host + MFA later	Default “any” — attackers scan 443

Runbook

Side A — cables
WAN port1 203.0.113.10/29. LAN port2 10.20.30.1/24. Create zone LAN, zone WAN.
Side B — admin
New admin, trusted host 10.20.30.0/24. Disable HTTP on WAN. Set DNS 1.1.1.1 + 10.20.30.10. NTP.
Side C — prove
execute ping 1.1.1.1, execute time, browser to https://10.10.10.1 from Priya only.

First-day proof

config system interface
    edit "port1"
        set vdom "root"
        set ip 203.0.113.10 255.255.255.248
        set allowaccess ping
        set role wan
    next
end
execute ping 1.1.1.1
# 5 packets transmitted, 5 packets received

Four failures

1 · WAN allowaccess https ping

Internet scans you. Restrict trusted-host or move admin to a dedicated mgmt port (this lab: 10.10.10.1).

2 · No DNS

FortiGuard, FQDN objects, SSL-VPN portals fail in “mysterious” ways.

3 · Clock wrong

VPN certs, logs, FortiGuard. Set NTP before IPsec.

4 · Temporary any-any

It ships to production. Use a timed test policy with logging, then delete it.

How to prove it

Close first day only when

1) Zones exist. 2) WAN has no open HTTPS from the world. 3) Ping + DNS + time work. 4) You have not written the any-any yet.

Traps

Symptom	First proof	Wrong fix
FQDN object empty	DNS on FGT	Disable UTM
VPN Phase-1 cert fail	NTP	New PSK
Locked out of GUI	trusted host + allowaccess	Factory reset too early — use console

FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview