How to Configure Interfaces and Firewall Policies on a FortiGate Firewall

Setting up a new firewall requires establishing network connectivity before implementing security control. FortiGate appliances operate on a zero-trust model by default. Every physical or logical interface drops all incoming and outgoing traffic until you explicitly assign IP addresses, configure routing, and create security policies. Understanding how to configure FortiGate interfaces and firewall policies forms the foundation of modern network engineering.

In this guide, you will learn how to configure network interfaces, establish static routing, construct firewall policies, and enable Source Network Address Translation (SNAT). Furthermore, we will walk through packet flow dynamics, verification techniques, and flow debugging workflows.

Real-Life Scenario

A corporate enterprise is deploying a new FortiGate appliance at a remote branch office. The local Internet Service Provider (ISP) delivered a static public IPv4 subnet. The internal operations team created a local network for branch workstations.

Your objective is to connect the branch office to the internet safely. You must configure the internet-facing WAN interface and the internal LAN interface. Additionally, you must build a static default route toward the ISP, create address objects for the subnet, and configure an outbound firewall policy with NAT enabled. The firewall must permit internal users to reach public resources while blocking unauthorized inbound connections from the internet.

Lab Topology

The network topology for this scenario contains a single FortiGate unit positioned between the ISP edge router and the local branch network. All IP addresses used in this tutorial are standard documentation addresses reserved for demonstration purposes.

                      +-------------------+
                      |     Internet      |
                      +---------+---------+
                                |
                                | Public IPv4: 203.0.113.1/24
                        [ ISP Gateway Router ]
                                |
                                | Public IPv4: 203.0.113.10/24
                       +--------+--------+
                       |   port1 (WAN)   |
                       |                 |
                       |    FortiGate    |
                       |                 |
                       |   port2 (LAN)   |
                       +--------+--------+
                                | Internal Gateway: 192.0.2.1/24
                                |
                        [ Layer 2 Switch ]
                                |
                                | Subnet: 192.0.2.0/24
                        +-------+-------+
                        |  Branch Client |
                        | (192.0.2.50)  |
                        +---------------+

Example Addressing and Objects

The following table details the network addressing scheme and firewall configuration parameters used throughout this lab environment.

Prerequisites

• Administrative access to a FortiGate firewall running FortiOS version 7.x via Web GUI or CLI.
• Basic understanding of IPv4 routing, subnetting, and stateful inspection concepts.
• Unused network interfaces (referred to as port1 and port2 in standard desktop/rack models).
• Assigned IP parameters from your ISP and internal IP allocation plans.

Note: FortiOS menu structures and command syntax may vary slightly depending on your hardware model, virtual domain (VDOM) configuration, feature visibility switches, and software version. Adapt these lab values to match your specific production environment.

Step-by-Step GUI Configuration

Step 1: Configure the WAN Interface

First, configure the external interface connecting to the service provider.

1. Log in to the FortiGate Web GUI.
2. Navigate to Network > Interfaces.
3. Select port1 and click Edit (or double-click the row).
4. Set the Alias to WAN_ISP1 to clearly mark the interface usage.
5. Set Role to WAN.
6. Under Addressing Mode, select Manual.
7. In the IP/Netmask field, enter 203.0.113.10/255.255.255.0 (or 203.0.113.10/24).
8. Under Administrative Access, enable only PING for diagnostic tests. Keep management protocols like HTTPS and SSH disabled on public WAN interfaces.
9. Click OK to save the configuration.

Step 2: Configure the LAN Interface

Next, configure the internal interface serving local branch clients.

1. Navigate to Network > Interfaces.
2. Select port2 and click Edit.
3. Set the Alias to LAN_Internal.
4. Set Role to LAN.
5. Under Addressing Mode, select Manual.
6. In the IP/Netmask field, enter 192.0.2.1/255.255.255.0.
7. Under Administrative Access, select HTTPS, SSH, and PING to allow secure internal management access.
8. Click OK.

Step 3: Configure the Static Default Route

Without an outbound route, the FortiGate cannot forward egress packets to external destination addresses.

1. Navigate to Network > Static Routes.
2. Click Create New.
3. Leave the Destination set to Subnet with 0.0.0.0/0.0.0.0 (quad-zero default route).
4. In the Gateway Address field, enter 203.0.113.1 (the ISP upstream router IP).
5. Set the Interface dropdown to port1 (or WAN_ISP1).
6. Keep administrative distance set to the default value of 10.
7. Click OK.

Step 4: Create the Internal Network Address Object

Define reusable firewall objects to specify matching criteria within your security policy rules.

1. Navigate to Policy & Objects > Addresses.
2. Click Create New and select Address.
3. Enter LAN_Subnet in the Name field.
4. Set Type to Subnet.
5. In the IP/Netmask field, enter 192.0.2.0/24 (or 192.0.2.0/255.255.255.0).
6. Set Associated Interface to port2 (or leave as Any).
7. Click OK.

Step 5: Create the Firewall Policy

Finally, tie the interfaces, address objects, and translation rules together into an active policy rule.

1. Navigate to Policy & Objects > Firewall Policy.
2. Click Create New.
3. Configure the policy options as follows:
   • Name: LAN_to_WAN_Outbound
   • Incoming Interface: port2 (LAN_Internal)
   • Outgoing Interface: port1 (WAN_ISP1)
   • Source: Select LAN_Subnet
   • Destination: Select all
   • Schedule: Select always
   • Service: Select ALL (or restrict to HTTP, HTTPS, DNS depending on security posture)
   • Action: Select ACCEPT
4. Scroll down to the Firewall / Network Options section.
5. Toggle NAT to Enabled.
6. Ensure IP Pool Configuration is set to Use Outgoing Interface Address.
7. Under Log Allowed Traffic, select All Sessions during initial installation to simplify troubleshooting.
8. Verify that Enable this policy is switched on.
9. Click OK.

CLI Section

For engineers who prefer the Command Line Interface (CLI) via SSH or console access, you can apply the identical configuration using standard FortiOS configuration blocks.

Configure Interfaces

config system interface
    edit "port1"
        set alias "WAN_ISP1"
        set mode static
        set ip 203.0.113.10 255.255.255.0
        set allowaccess ping
        set role wan
    next
    edit "port2"
        set alias "LAN_Internal"
        set mode static
        set ip 192.0.2.1 255.255.255.0
        set allowaccess ping https ssh
        set role lan
    next
end

Configure Static Route

config router static
    edit 1
        set dst 0.0.0.0 0.0.0.0
        set gateway 203.0.113.1
        set device "port1"
    next
end

Configure Firewall Address Object

config firewall address
    edit "LAN_Subnet"
        set type ipmask
        set subnet 192.0.2.0 255.255.255.0
        set associated-interface "port2"
    next
end

Configure Outbound Firewall Policy

config firewall policy
    edit 1
        set name "LAN_to_WAN_Outbound"
        set srcintf "port2"
        set dstintf "port1"
        set action accept
        set srcaddr "LAN_Subnet"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set nat enable
        set logtraffic all
    next
end

How the Traffic Flows

Understanding packet processing within FortiOS helps diagnose communication failures quickly. When an endpoint host at 192.0.2.50 initiates a connection to a web server at 198.51.100.25, the FortiGate processes the packet through a sequential lifecycle:

1. Ingress Processing: The frame arrives on port2. The FortiGate verifies interface status, checks for valid VLAN tags (if configured), and verifies that ingress security options permit processing.
2. Routing Table Lookup (FIB Check): The engine examines the destination IP address (198.51.100.25). It queries the Forwarding Information Base (FIB) to locate an egress path. The system matches the static default route (0.0.0.0/0) pointing out port1 via gateway 203.0.113.1.
3. Firewall Policy Matching: FortiOS evaluates active firewall policies top-to-bottom. It checks four mandatory criteria:
   • Incoming Interface (port2)
   • Outgoing Interface (port1)
   • Source IP (192.0.2.50 matching LAN_Subnet)
   • Destination IP (198.51.100.25 matching all)
4. Stateful Session Creation: Upon matching Policy ID 1, FortiOS creates a state entry in the system kernel session table. The firewall tracks connection parameters, TCP sequence numbers, and interface bindings.
5. Source NAT Application: Because Policy ID 1 has NAT enabled using the egress interface mode, the kernel rewrites the IP header. The original source IP (192.0.2.50) changes to the WAN interface IP (203.0.113.10). It assigns a unique source port for translation tracking.
6. Egress Processing: The modified packet exits port1 toward the ISP gateway.
7. Return Packet Handling: When the web server replies to 203.0.113.10, the FortiGate checks its active session table. Because stateful inspection tracks existing connections, return traffic matches the existing session automatically. The firewall bypasses policy lookup, restores the original destination IP (192.0.2.50), and forwards the packet out port2.

Verification

Confirm proper firewall operation by conducting checks on the local host and FortiGate CLI.

1. Check Routing Table from CLI

Execute the following command to verify the active IPv4 routing table in the kernel:

get router info routing-table all

Expected Output Excerpt:

S*      0.0.0.0/0 [10/0] via 203.0.113.1, port1
C       192.0.2.0/24 is directly connected, port2
C       203.0.113.0/24 is directly connected, port1

The routing table must show a candidate default route (marked with S*) pointing out your egress WAN interface.

2. Active Session Table Inspection

Send continuous outbound traffic from a LAN host (for example, pinging 198.51.100.25). Then filter the session table on the FortiGate CLI using the client’s internal host address:

diagnose sys session filter saddr 192.0.2.50
diagnose sys session list

Expected Output Excerpt:

session info: proto=1 proto_state=01 duration=4 expire=56 timeout=60 flags=00000000 sockdef/sockport=0/0
	proto_statename=ICMP
	pkts/bytes(req): 1/84 pkts/bytes(resp): 1/84
	state=may_dirty npu
	statistic(total): packets=1 bytes=84 active1=1
	src/dst: 192.0.2.50->198.51.100.25 id=1 dir=org act=noop
	src/dst: 198.51.100.25->203.0.113.10 id=1 dir=reply act=snat
	hook=post dir=org act=snat 203.0.113.10:61440
	misc=0 policy_id=1 auth_info=0 vd=0

This session entry confirms that packet direction org (original) comes from 192.0.2.50, while reply traffic hits 203.0.113.10 using policy ID 1 with active SNAT.

Troubleshooting

When outbound connectivity fails, follow a structured troubleshooting methodology: Link Layer -> Routing -> Firewall Policy -> Session Execution.

Step-by-Step Flow Debugging

FortiOS contains a packet tracing tool that displays real-time flow decisions made by the kernel CPU. Run this command sequence to analyze drops or forwarding failures.

CAUTION: In production environments with high traffic volume, always apply tight filters (such as specific host addresses) to avoid overwhelming CPU resources or flooding log consoles.

diagnose debug reset
diagnose debug flow filter saddr 192.0.2.50
diagnose debug flow show console enable
diagnose debug flow trace start 10
diagnose debug enable

Initiate traffic from the client host while observing the terminal output. A successful trace output appears as follows:

id=68586 trace_id=1 msg="vd-root:0 received a packet(proto=1, 192.0.2.50:1->198.51.100.25:8) from port2. type=8, code=0, id=1, seq=1."
id=68586 trace_id=1 msg="allocate a new session-0000c12a, npu flag=00000000"
id=68586 trace_id=1 msg="find a route: flag=00000001 gw-203.0.113.1 via port1"
id=68586 trace_id=1 msg="Allowed by Policy-1:"
id=68586 trace_id=1 msg="SNAT 192.0.2.50->203.0.113.10:61440"

Interpreting Debug Trace Results

Safely Disable Debugging

Once diagnostics are complete, turn off debugging and clear operational trace filters immediately:

diagnose debug disable
diagnose debug reset

Common Mistakes

• Forgetting to Enable NAT on Policy: Outbound packets leave the firewall containing private IP addresses (RFC 1918). Upstream ISP routers drop these packets because private ranges are non-routable on the public internet.
• Reversing Source and Destination Interfaces: Setting the incoming interface as port1 and outgoing interface as port2 blocks internal outbound client access. Always establish rules relative to the traffic initiation path.
• Missing Default Static Route: Configuring interfaces and security rules without a default static route leaves packets stranded at the firewall. The kernel drops packets missing destination FIB entries.
• Assuming Central NAT Applies to Basic Policies: By default, FortiOS utilizes Policy NAT (NAT configured within the firewall rule). If Central NAT is manually enabled globally, port-level policy NAT parameters are hidden, requiring configuration under Policy & Objects > Central SNAT.
• Misunderstanding Implicit Deny Rule 0: FortiGate appliances enforce an unseen, default policy rule at the bottom of the table blocking all unmatched connections. Every permitted flow requires explicit rule creation.

Production Considerations

While the configuration shown in this tutorial establishes connectivity, production deployments require extra hardening and structure:

• Restrict Allowed Administrative Protocols: Never allow administrative management interfaces (HTTP, HTTPS, SSH) on untrusted public WAN interfaces. Restrict local administration strictly to secure LAN subnets or dedicated management interfaces.
• Apply Security Profiles: Outbound policies should not rely purely on layer 4 firewalling. Apply security inspection profiles—such as Antivirus, Web Filter, Application Control, and IPS—to inspect allowed outbound flows for threats.
• Restrict Allowed Services: Avoid using the generic ALL service object in enterprise production policies. Define strict, granular services (for example, port 80 HTTP, port 443 HTTPS, and port 53 DNS) to limit lateral threat vectors.
• Configure Explicit IP Pools when Necessary: When managing multi-IP public blocks, switch from Use Outgoing Interface Address to designated IP Pools under Policy & Objects > IP Pools to maintain dedicated mapping policies for internal servers or specific departmental subnets.

Summary

Configuring interfaces, routing, and stateful security rules represents the core foundation of enterprise networking on FortiGate firewalls. FortiOS relies on clear directional design: physical/logical interfaces process traffic, the FIB handles route table selection, address objects identify traffic endpoints, and firewall policies evaluate permissions while applying translation rules.

By mastering interface bindings, default static routes, address object generation, and policy NAT, you ensure safe edge connectivity across enterprise networks. Utilizing real-time verification tools like get router info routing-table and diagnose debug flow allows you to validate stateful session flows and resolve routing or policy blockages efficiently.