Every firewall deployment you will ever inherit falls into one of two categories: one you built yourself from a clean slate, or one somebody else configured and left undocumented. The first lab in our FortiGate Masterclass exists because the second category is where outages and breaches come from. Before you write a single firewall policy, you need a device in a state you fully understand.
This post is a public reference for Lab 1.1 — FortiGate Factory Reset and Management Access. The lab itself, with its guided steps and graded submission, is available to enrolled students; what follows is the substance of what it teaches.
What the lab covers
- Reaching a FortiGate through its console when no IP-based access exists yet
- Performing a factory reset to return the appliance to a known baseline
- Setting the initial administrator password and understanding the forced-change prompt
- Configuring a dedicated management interface with a static address
- Choosing which administrative services to expose on that interface (
ping,ssh,https,http) - Completing the initial setup wizard and understanding what each option actually changes
- Setting the device hostname, idle timeout, and system time zone
- Verifying access three ways — ICMP, HTTPS GUI, and SSH
- Exporting a configuration backup as the deliverable
The concepts behind it
The management plane is not the data plane. A FortiGate separates the traffic it forwards from the traffic that terminates on the device itself. Administrative access lives on the management plane, and treating it as a distinct security domain — its own interface, its own address range, its own access rules — is the difference between a hardened deployment and a flat one. Students who skip this distinction end up exposing HTTPS administration on a WAN interface, which is one of the most common real-world misconfigurations in perimeter security.
allowaccess is an access-control decision, not a convenience setting. Each protocol you enable on an interface is an additional service listening for connections. Enabling HTTP alongside HTTPS, for example, is fine in a controlled lab and indefensible on an internet-facing port. The lab makes students state that choice explicitly rather than accept a default.
Factory reset is a diagnostic tool, not just a starting ritual. Knowing how to return a device to baseline — and knowing what survives a reset and what does not — is a skill that matters during incident response, hardware RMA, and when you take over an appliance whose history you cannot verify.
The certificate warning is a teaching moment. A freshly reset FortiGate presents a self-signed certificate on its GUI. Students are told to proceed past the warning here, then in a later lab they replace that certificate properly with one issued by a certificate authority. Understanding why the warning appears — and why clicking through it is acceptable on a console-attached lab device but not on production management access — sets up the entire certificates module.
Time and session hygiene matter. Setting the correct time zone is not cosmetic. Log correlation, certificate validity checks, scheduled policies, and two-factor authentication all depend on accurate device time. Students who get this wrong here spend hours debugging OTP failures several labs later.
What students gain
By the end of this lab a student can take an unconfigured FortiGate, bring it to a documented baseline, establish secure administrative access over both GUI and CLI, and prove that access works. They can also produce a configuration backup — the artefact that every subsequent lab builds on, and the same artefact you would capture before any production change window.
How it is assessed
Students export the resulting device configuration and submit it through the portal. Submissions are graded against a rubric that checks the specific settings the lab asked for, so a student who clicked through the wizard without understanding it does not pass by accident.
Where it fits
Lab 1.1 opens the FortiGate Masterclass. Every later lab — interfaces and zones, NAT, firewall policies, routing, VPN, high availability — assumes the device is in the state this lab produces. It is the foundation the rest of the course is stacked on.
Explore the full FortiGate Masterclass in our course catalogue.