// project writeup

FortiGate VM Firewall Lab
Enterprise Firewall Deployment & Policy Configuration

Status ✓ Completed
Date June 2026
Platform VMware Workstation Pro 26H1
Firmware FortiOS v7.4.12 (Mature)
Skills
FortiGate FortiOS CLI VMware Workstation Network Policy FortiCloud Firewall Rules

// overview

This lab covers the full deployment lifecycle of a FortiGate-VM — from sourcing the correct image and navigating hypervisor compatibility issues, through CLI-based interface configuration, GUI access, and FortiCloud license activation, to building and ordering a real firewall policy set. The goal was to get hands-on with FortiOS fundamentals: CLI syntax, zone-based policy logic, Internet Service objects, and traffic logging.

// lab environment

🖥️

Hypervisor

VMware Workstation Pro 26H1 — FortiGate's native virtualisation platform, eliminating hardware compatibility issues present with VirtualBox

🔥

FortiGate-VM

FortiOS v7.4.12 (Mature build) — imported via OVF from Fortinet's official VM download portal using a free FortiCare account

🌐

WAN (port1)

VMware NAT adapter — FortiGate receives a DHCP lease from VMware's NAT engine and routes internet traffic through the host machine

🔒

LAN (port2)

VMware Host-only adapter (VMnet1, 192.168.122.0/24) — provides isolated management access and simulates a LAN segment for client traffic

// deployment steps

  1. Downloaded FortiGate-VM OVF package (v7.4.12) from Fortinet's VM image download portal using a free FortiCare account
  2. Imported OVF into VMware Workstation Pro — configured port1 as Bridged/NAT (WAN) and port2 as Host-only VMnet1 (LAN)
  3. Completed first-boot login via VMware console, set admin password, and configured port2 with a static IP for management access
  4. Accessed the FortiGate web GUI at https://192.168.122.254 from the host browser
  5. Activated the permanent evaluation license via FortiCloud credentials in the GUI — FortiGate rebooted and came up fully licensed
  6. Verified internet connectivity from FortiGate CLI with execute ping 8.8.8.8 — 0% packet loss confirmed
FortiGate-VM64 # config system interface FortiGate-VM64 (interface) # edit port2 FortiGate-VM64 (port2) # set mode static FortiGate-VM64 (port2) # set ip 192.168.122.254 255.255.255.0 FortiGate-VM64 (port2) # set allowaccess https ping ssh FortiGate-VM64 (port2) # end FortiGate-VM64 # execute ping 8.8.8.8 PING 8.8.8.8: 56 data bytes 64 bytes from 8.8.8.8: icmp_seq=0 ttl=128 time=14.9 ms --- 8.8.8.8 ping statistics --- 5 packets transmitted, 5 received, 0% packet loss

// firewall policy configuration

Built a structured three-tier policy set demonstrating proper rule hierarchy — specific deny rules above general allow rules, with FortiGate's implicit deny-all as the final catch. Used FortiGate's Internet Service Database (ISDB) to block Facebook by service category rather than raw IP, which is a more realistic and maintainable enterprise approach.

# Policy Name Source Destination Action Log
1 Block-Facebook all Facebook-Web, DNS, ICMP ⊘ DENY ✓
2 LAN-to-WAN-Allow all all ✓ ACCEPT ✓
— implicit_deny all all ⊘ DENY (default) —

Rule ordering is critical: FortiGate evaluates policies top-to-bottom and matches on the first hit. The Block-Facebook deny rule must sit above the general LAN-to-WAN allow rule, otherwise Facebook traffic would be permitted before the deny is evaluated.