# First day: interfaces and zones before the first policy Source: https://ai.techclick.in/blog_fortigate_first_day_interfaces_zones Markdown: https://ai.techclick.in/blog_fortigate_first_day_interfaces_zones.md Publisher: Techclick Infosec Pvt Ltd First-day FortiGate: WAN/LAN, zone, admin HTTPS, DNS, NTP. Dummy WAN 203.0.113.10 LAN 10.20.30.0/24. ## The ticket Junior built 40 policies on port1 / port2 . Hardware swap changes the port map. Every policy is now wrong. Zones would have survived. Quick interview answer First day is Network → Interfaces (addressing, role WAN/LAN, allow-access), optional Network → Zones so policy uses LAN not port2 , then System → Settings / Administrators (HTTPS, trusted hosts), Network → DNS and NTP. FortiOS 7.4 Admin Guide: interface role and allowaccess are first-class fields. Never leave HTTP + ping open on WAN. Hero · first console Name the cable before you write the rule. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model - Interface = a cable + IP + allowaccess. - Zone = a bucket of interfaces you use in policy (LAN, WAN, DMZ). - Role in 7.4 (LAN/WAN/DMZ/undefined) drives GUI hints, not security by itself. https://fgt-hq.techclick-lab.in Training mock · not live Admin Dashboard Policy VPN Network Network → Interfaces ### Edit interface port2 (LAN) Alias LAN Addressing mode Manual 10.20.30.1/24 Role LAN Administrative access HTTPS, SSH, PING (LAN only) Zone LAN Cancel Save FortiOS 7.4 Network → Interfaces. Training mock. ## How to choose Choice Use Skip when Policy on raw ports Tiny lab, one cable forever Any HA or hardware refresh Zones This class + production You enjoy rewriting 80 policies Allowaccess HTTPS on WAN Break-glass with trusted host + MFA later Default “any” — attackers scan 443 ## Runbook - #### Side A — cables WAN port1 203.0.113.10/29. LAN port2 10.20.30.1/24. Create zone LAN, zone WAN. - #### Side B — admin New admin, trusted host 10.20.30.0/24. Disable HTTP on WAN. Set DNS 1.1.1.1 + 10.20.30.10. NTP. - #### Side C — prove execute ping 1.1.1.1 , execute time , browser to https://10.10.10.1 from Priya only. First-day proof config system interface edit "port1" set vdom "root" set ip 203.0.113.10 255.255.255.248 set allowaccess ping set role wan next end execute ping 1.1.1.1 # 5 packets transmitted, 5 packets received ## Four failures ### 1 · WAN allowaccess https ping Internet scans you. Restrict trusted-host or move admin to a dedicated mgmt port (this lab: 10.10.10.1). ### 2 · No DNS FortiGuard, FQDN objects, SSL-VPN portals fail in “mysterious” ways. ### 3 · Clock wrong VPN certs, logs, FortiGuard. Set NTP before IPsec. ### 4 · Temporary any-any It ships to production. Use a timed test policy with logging, then delete it. ## How to prove it Close first day only when 1) Zones exist. 2) WAN has no open HTTPS from the world. 3) Ping + DNS + time work. 4) You have not written the any-any yet. ## Traps Symptom First proof Wrong fix FQDN object empty DNS on FGT Disable UTM VPN Phase-1 cert fail NTP New PSK Locked out of GUI trusted host + allowaccess Factory reset too early — use console ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Why put interfaces in a zone on day one? Zones encrypt traffic Policy survives port remaps / extra LAN cables Zones replace NAT FortiGuard requires zones Correct: b . Concept. Q2 WAN allowaccess should normally include… HTTPS SSH HTTP PING from any As little as possible; admin on mgmt/LAN + trusted host Telnet SNMP write Correct: b . Failure 1. Q3 FQDN address objects fail first because… No DNS on the FortiGate VDOM name HA priority VIP port-forward Correct: a . Failure 2. Q4 Role LAN/WAN in FortiOS 7.4 is… A hard security boundary by itself A GUI/role hint — policy/zone still do the work The same as a VDOM An SD-WAN member Correct: b . Concept. Q5 You lock HTTPS to 10.20.30.0/24 and then VPN in from home. What did you forget? A break-glass admin path / trusted host A VIP Central SNAT FAZ Correct: a . Trap: locked out. Q6 Best first-day test policy? any-any forever Narrow, logged, deleted after the ping test Disable implicit deny NAT off + any-any Correct: b . Failure 4. Check answers Reset FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview ## Sources - FortiOS 7.4 Administration Guide — Interface settings (role, allowaccess) . - FortiOS 7.4 — Zones . Related: FortiGate session factory · VPN series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt