FortiGate Firewall Policies and NAT

Configure firewall policies and NAT rules on a FortiGate-VM lab.

Introduction

30 Second Summary

Think about security guards at a building entrance. They check IDs, decide who can enter or leave, and redirect visitors to the right floor.

In this project, you will configure a FortiGate firewall in a virtual lab, creating policies that control traffic flow and setting up NAT rules that translate network addresses.

What You'll Build

A working FortiGate-VM firewall lab in VMware Workstation with configured interfaces, traffic control policies, and NAT translation rules that mirror a real enterprise network.

By the end of this project, you'll have:

  • A licensed FortiGate-VM with port1 configured on your VMware NAT network, accessible via both the web GUI and CLI.
  • Working firewall policies demonstrating implicit deny, policy matching order, and Source NAT for outbound traffic.
  • A Virtual IP (VIP) object configured for Destination NAT with port forwarding, translating inbound traffic to an internal address.
  • Secret Mission: Use diagnose debug flow to trace live packet processing through your firewall policies.

Are there any prerequisites?

Yes. You need VMware Workstation installed with a FortiGate-VM already deployed and your admin password set from first login.

You also need a Fortinet Support (FortiCare) account to activate the permanent trial license in the first step.

Activate the Trial License and Access the GUI

Before you can create firewall policies or configure NAT, you need network connectivity to your FortiGate-VM. Right now, the VM has no IP address on any interface, which means you cannot reach its web-based management GUI.

In this step, you will configure port1 with a DHCP address from the VMware NAT network, activate the permanent trial license through the GUI, and confirm that everything is working.

In this step, get ready to:
  • Configure port1 with a DHCP address and enable management access.
  • Activate the permanent evaluation license via the FortiGate GUI.
  • Log into the FortiGate dashboard and verify your license status.
Configure port1 IP address via the FortiGate CLI

Your FortiGate-VM needs an IP address so your Windows host can reach its web GUI. Port1 is connected to VMware's NAT network, which runs its own DHCP server. Setting port1 to DHCP mode lets it grab an IP automatically.

  • In the FortiGate CLI console (inside VMware Workstation), configure port1 by entering these commands one at a time:
config system interface
edit port1
set mode dhcp
set allowaccess ping https ssh http
next
end

What do these commands do?

  • config system interface enters the interface configuration mode.
  • edit port1 selects port1 for editing.
  • set mode dhcp tells port1 to obtain its IP address automatically from VMware's virtual DHCP server.
  • set allowaccess ping https ssh http enables management protocols on port1 so you can reach the GUI (HTTPS/HTTP) and test connectivity (ping).
  • next saves the port1 configuration, and end exits interface configuration mode.
  • Verify the assigned IP address by running this command:
get system interface physical

Look for the port1 section in the output. You should see mode: dhcp, status: up, and an ip: line showing an address in the 192.168.x.x range.

  • Write down the IP address shown for port1. You will need it to access the GUI in the next substep.

Not seeing an IP address on port1?

  • Make sure the FortiGate-VM's Network Adapter 1 is set to NAT mode in VMware Workstation. Right-click the VM, select Settings, then check Network Adapter.
  • If the IP shows 0.0.0.0, the VMware DHCP service may not be running. Restart VMware Workstation and try again.
  • Double-check that you typed set mode dhcp (not static) and that you entered end to commit the configuration.

Still stuck? Help me troubleshoot why port1 has no DHCP IP address on my FortiGate-VM in VMware Workstation.

Activate the permanent trial license

The FortiGate-VM ships with a permanent evaluation license that gives you access to core firewall features. You activate it through the web GUI using your FortiCare account credentials.

  • Open a web browser on your Windows host.
  • Navigate to the FortiGate GUI by entering this URL in your browser's address bar:
https://[[PORT1_IP="your port1 IP address (e.g. 192.168.72.128)"]]
  • Your browser will show a certificate warning because the FortiGate uses a self-signed certificate. Click Advanced, then Proceed (or Accept the Risk depending on your browser) to continue.
  • On the FortiGate VM License page, find the question "How will you license this VM?" and select Evaluation License.
  • In the Email field, enter your FortiCare account email address.
  • In the Password field, enter your FortiCare account password.
  • Click OK.

What happens next?

The FortiGate will download and apply the permanent trial license. This triggers an automatic reboot. Wait 1-2 minutes for the VM to come back up. You will know it is ready when the FortiGate login page loads in your browser again.

The evaluation license does not expire. It limits you to 1 CPU, 2 GB RAM, and a maximum of 3 interfaces, 3 firewall policies, and 3 routes. This is more than enough for this lab.

License page not loading?

  • Confirm that port1 has an IP by running get system interface physical in the VMware console. If it shows 0.0.0.0, revisit the previous substep.
  • Try both https:// and http:// followed by your port1 IP.
  • Make sure your Windows host firewall is not blocking outbound connections to the VMware NAT subnet.

Still stuck? Help me access the FortiGate GUI from my Windows host after configuring port1.

Log into the FortiGate GUI and verify your license

After the reboot, you can access the full FortiGate dashboard. This is where you will manage firewall policies and NAT rules for the rest of the project.

  • Navigate to the same URL in your browser:
https://[[PORT1_IP="your port1 IP address (e.g. 192.168.72.128)"]]
  • Accept the certificate warning again if prompted.
  • Log in with username admin and the password you set during first boot.

You should see the FortiGate dashboard with widgets showing system information, license status, and interface status.

  • Verify your license is active by running this command in the CLI Console widget (click the >_ icon in the top-right of the GUI):
get system status

What should I see?

The output of get system status shows your FortiGate's firmware version, serial number, and license information. Look for a line confirming your license is valid and that the VM is using the evaluation license.

✔️ I see License Status: Valid

Your FortiGate-VM is fully licensed and ready to go. You have confirmed GUI access and CLI access from within the GUI.

ⓧ License shows Warning or Invalid

This usually means the FortiGate could not validate the license with Fortinet's servers. The FortiGate-VM needs internet access through port1 to complete validation.

  • Confirm your Windows host has internet access.
  • Verify port1 has a valid IP (run get system interface physical in the VMware console).
  • Wait a few minutes and refresh the dashboard. The VM retries validation automatically.
  • If it persists for more than 5 minutes, reboot the VM from the VMware console and try logging in again.

ⓧ I cannot reach the login page

The FortiGate may still be rebooting after license activation.

  • Wait 2 minutes and try refreshing your browser.
  • Check the VMware console. If you see the FortiGate login prompt in the console, the VM is up. Try the browser again.
  • If the port1 IP changed after reboot (unlikely but possible with DHCP), run get system interface physical in the VMware console to get the new IP.

Your FortiGate-VM is licensed, connected, and accessible through both the GUI and CLI. Next up, you will configure system settings and explore the dashboard to understand the tools at your disposal.

Configure System Settings and Explore the Dashboard

Your FortiGate-VM is now licensed and accessible through the web GUI. That means you have a working lab environment ready for configuration.

Before building firewall policies, you need to configure basic system settings. A meaningful hostname helps you identify this device in a multi-firewall environment. DNS servers allow the FortiGate to resolve domain names for updates and network diagnostics.

In this step, get ready to:
  • Set a hostname and configure DNS servers.
  • Explore the interface configuration page.
  • Review the FortiGate dashboard widgets.
Set a hostname and DNS servers

The hostname identifies your FortiGate in the CLI prompt, SNMP, and the dashboard. Setting DNS servers lets the device resolve domain names for connectivity tests and updates.

GUI

  • In the FortiGate GUI, navigate to System > Settings.
  • In the Host name field, change the value to FGT-LAB1.
  • Set Primary DNS Server to 8.8.8.8.
  • Set Secondary DNS Server to 8.8.4.4.
  • Click Apply.

CLI

  • Set the hostname by entering these commands in the CLI Console:
config system global
    set hostname FGT-LAB1
end
  • Configure the DNS servers by entering these commands:
config system dns
    set primary 8.8.8.8
    set secondary 8.8.4.4
end

What do these settings do?

The hostname appears in your CLI prompt, the System Information dashboard widget, and as the SNMP system name. It helps you identify this specific device when managing multiple firewalls.

The DNS servers (Google's public DNS) allow your FortiGate to resolve domain names. Without DNS configured, commands like execute ping google.com would fail because the firewall cannot translate the domain to an IP address.

  • Verify the hostname appears as FGT-LAB1 in the top-left corner of the GUI.
  • Confirm DNS is working by running this command in the CLI Console:
execute ping google.com

You should see output showing the resolved IP address and ICMP replies, confirming that DNS resolution is working.

Ping not resolving the domain name?

  • Double-check that you entered 8.8.8.8 as the primary DNS and 8.8.4.4 as secondary. A typo in either field will prevent resolution.
  • Make sure port1 has internet connectivity. Run execute ping 8.8.8.8 to test raw IP connectivity first. If that fails, your VMware NAT network may not be routing traffic.
  • If you used the CLI method, confirm you typed end after each config block. Missing end means the configuration was never committed.

Help me troubleshoot why my FortiGate DNS ping is not resolving domain names after configuring DNS servers.

Explore the interface configuration

Interfaces define how your FortiGate connects to different network segments. Each interface has its own IP address, access permissions, and role in the network topology.

  • Navigate to Network > Interfaces.
  • Observe that you have port1 (with your DHCP address) and port2 listed.
  • Click on port1 to view its full configuration.
  • Notice the Administrative Access checkboxes showing which protocols are allowed (HTTPS, HTTP, SSH, PING). These are the access settings you configured via CLI in the previous step.

Why only 3 interfaces?

The FortiGate-VM trial license limits you to a maximum of 3 interfaces. In a production environment with a full license, you would typically have many more interfaces representing different network zones (LAN, WAN, DMZ, Guest, etc.).

For this lab, port1 acts as your WAN connection (internet-facing via VMware NAT) and port2 represents an internal network segment. This two-interface setup is enough to demonstrate firewall policy concepts.

Review the FortiGate dashboard

The dashboard is where you monitor the overall health of a FortiGate in production. It gives you a quick view of system status, license information, and network activity.

  • Return to the Dashboard by clicking Dashboard in the left navigation menu.
  • Identify the System Information widget. This shows your hostname (FGT-LAB1), firmware version, and serial number.
  • Locate the License Information widget. This shows your trial license limitations.
  • Find the Network widget showing interface status and traffic activity.

What are these dashboard widgets for?

In a production FortiGate, the dashboard is your first stop for health monitoring. System Information tells you at a glance which firmware you are running and the device serial number. License Information shows which services are active (on a full license, this includes FortiGuard subscriptions).

The Network widget visualizes real-time traffic flowing through each interface. You may also see a Security Fabric widget, but this is not applicable on the trial license.

  • Check CPU and memory usage by running this command in the CLI Console:
get system performance status

You should see output showing CPU and memory percentages. On a fresh lab with no traffic, both values should be very low.

Your FortiGate is now properly configured with a meaningful hostname and working DNS. Next up, you will create firewall policies that control how traffic flows between interfaces.

Create Firewall Policies

Your FortiGate lab is configured and accessible. Now it is time to control traffic.

Without firewall policies, a FortiGate blocks everything by default. In this step you will create policies that explicitly allow or deny traffic between interfaces, and learn how policy order determines which rule wins.

In this step, get ready to:
  • Understand the implicit deny and create an outbound allow policy.
  • Create a deny policy and configure policy matching order.
  • Verify your policies via the CLI.
Understand the implicit deny and create your first policy

Every FortiGate has an invisible rule at the bottom of its policy table called the implicit deny. It blocks all traffic that does not match an explicit policy above it.

  • In the FortiGate GUI, navigate to Policy & Objects in the left sidebar.
  • Click Firewall Policy.

You should see an empty policy list (or only a default deny entry). This confirms that all traffic is currently blocked.

What is the implicit deny?

FortiGate evaluates firewall policies from top to bottom. If a packet does not match any policy, it hits the implicit deny at the bottom and gets dropped.

This is a core NSE 4 concept. Traffic must match a policy to be forwarded.

Now create your first policy to allow outbound traffic.

  • Click Create New at the top of the policy list.
  • In the Name field, enter Allow-Outbound.
  • Set Incoming Interface to port2.
  • Set Outgoing Interface to port1.
  • Set Source to all.
  • Set Destination to all.
  • Set Service to ALL.
  • Set Action to ACCEPT.
  • Enable NAT by toggling it on. This enables Source NAT using the outgoing interface IP by default.
  • Under Logging Options, set Log Allowed Traffic to All Sessions.
  • Click OK.

What does this policy do?

This policy tells the FortiGate: accept any traffic arriving on port2 that wants to leave via port1. Before sending it out, replace the source IP with port1's own IP address (Source NAT).

This is the most common enterprise configuration for letting internal devices reach the internet.

You should now see one policy listed in the Firewall Policy table named Allow-Outbound.

Create a deny policy and configure policy order

FortiGate evaluates policies from top to bottom and uses the first match. Once a packet matches a policy, no further policies are checked. You will now create a deny policy and position it above the allow policy to see this ordering in action.

  • Click Create New again to add a second firewall policy.
  • In the Name field, enter Deny-Social-Media.
  • Set Incoming Interface to port2.
  • Set Outgoing Interface to port1.
  • Set Source to all.
  • Set Destination to all.
  • Set Service to HTTP and HTTPS.
  • Set Action to DENY.
  • Enable Log Violation Traffic.
  • Click OK.

You should now see two policies in the list. The next step is to reorder them so the deny rule is checked first.

  • In the policy list, drag Deny-Social-Media ABOVE Allow-Outbound.

Why does policy order matter?

With Deny-Social-Media on top, any HTTP or HTTPS traffic from port2 to port1 hits the deny rule first and gets blocked. All other traffic (DNS, SSH, etc.) skips that policy because the service does not match, and falls through to Allow-Outbound below.

If you reversed the order, the allow-all rule would match everything first, and the deny rule would never trigger. This first-match behavior is heavily tested on the NSE 4 exam.

Trial license policy limit

The FortiGate-VM permanent trial license allows a maximum of 3 firewall policies. You are now using 2 of your 3 available slots. The third slot is reserved for the next step when you create an inbound VIP policy.

Can't drag the policy to reorder?

Make sure you are viewing policies in the By Sequence view. Click the view dropdown at the top of the policy list and select By Sequence if it is not already active.

Help me reorder my FortiGate firewall policies

Verify your policies via the CLI

The CLI gives you a text-based view of everything you just configured in the GUI. This is essential for the NSE 4 exam, where you must read policy configurations in CLI format.

  • Open the CLI Console from the FortiGate GUI (click the >_ icon in the top-right area of the dashboard).
  • Display your configured policies by running this command:
show firewall policy

What does this command show?

This displays all your configured policies with their sequence IDs, interface assignments, source/destination addresses, services, actions, and NAT settings. Notice how the policy ID numbers map to the order you see in the GUI.

  • Run the diagnostic command to see the compiled policy table:
diagnose firewall policy list

What does this diagnostic show?

This displays the internal policy table the FortiGate uses for matching. It shows how the kernel actually evaluates traffic against your policies, including interface zones and match criteria.

You should see 2 policies listed. Deny-Social-Media appears first (position 1) and Allow-Outbound appears second (position 2).

Seeing only one policy or wrong order?

If only one policy appears, confirm you clicked OK (not Cancel) after filling in the second policy. Return to Policy & Objects > Firewall Policy in the GUI to check.

If the order is reversed, drag Deny-Social-Media above Allow-Outbound in the GUI, then re-run show firewall policy to confirm.

Help me fix my policy order

Your firewall is now actively controlling traffic between interfaces. Next up, you will configure NAT translation rules to handle how addresses get rewritten as packets cross the FortiGate.

Configure Source NAT and Destination NAT (VIP)

Your firewall policies are in place and controlling traffic between interfaces. Now it is time to tackle the second critical piece of FortiGate traffic management: address translation.

In this step, you will verify how Source NAT works on your existing outbound policy, then create a Virtual IP (VIP) to handle Destination NAT for inbound traffic. These two NAT types cover how enterprises handle both outgoing and incoming connections through a firewall.

In this step, get ready to:
  • Verify Source NAT on your Allow-Outbound policy via the CLI.
  • Create a Virtual IP object for Destination NAT with port forwarding.
  • Create an inbound firewall policy using the VIP as the destination.
Examine the Source NAT on your existing policy

Your "Allow-Outbound" policy already has NAT enabled. This is Source NAT (SNAT). It replaces the source IP address of traffic leaving port1 with port1's own IP address, so devices on the internal network can share a single public-facing IP.

  • In the FortiGate GUI, navigate to Policy & Objects.
  • Click Firewall Policy.
  • Double-click the Allow-Outbound policy to edit it.
  • Scroll down to the NAT section. You will see it is toggled on, with Use Outgoing Interface Address selected by default.
  • Click Cancel to close the editor without making changes.

What is Use Outgoing Interface Address?

This setting tells the FortiGate to replace the original source IP of every packet with port1's DHCP-assigned IP address before sending it onward. Every device behind port2 appears to come from the same IP.

This is the most common NAT configuration in enterprise networks. Internal users share one public IP without exposing their individual addresses.

Now verify the same setting from the CLI. This is the method you will use on the NSE 4 exam.

  • Open the CLI Console from the FortiGate GUI (click the >_ icon in the top-right area of the dashboard).
  • Verify the SNAT setting by running this command:
show firewall policy 1

Look through the output for the line set nat enable. This confirms Source NAT is active on this policy.

What does the policy ID number mean?

The number 1 in the command refers to the policy ID, not the display position. Policy IDs are assigned in creation order. Since Allow-Outbound was created first, it received ID 1.

The GUI shows policies ordered by matching priority (top to bottom). The CLI show firewall policy command without an ID number shows all policies in that same priority order.

Not seeing set nat enable in the output?

Make sure you entered the correct policy ID. If your Allow-Outbound policy was not the first one created, its ID may differ. Run show firewall policy without a number to see all policies and find the one named "Allow-Outbound".

Help me find the correct policy ID for my Allow-Outbound policy.

Create a Virtual IP for Destination NAT

Source NAT handles outbound traffic. For inbound traffic, you need Destination NAT (DNAT). On FortiGate, DNAT is configured using a Virtual IP (VIP) object that maps an external address and port to an internal address and port.

  • In the FortiGate GUI, navigate to Policy & Objects.
  • Click Virtual IPs.
  • Click Create New, then select Virtual IP.
  • In the Name field, enter VIP-WebServer.
  • Set Interface to port1 (this is the interface where inbound traffic arrives).
  • In the External IP Address/Range field, enter port1's DHCP-assigned IP address (the same IP you use to access the GUI).
  • In the Mapped IP Address/Range field, enter 10.10.10.100 (this represents an internal web server address).
  • Enable Port Forwarding.
  • Set External Service Port to 8080.
  • Set Map to Port to 80.
  • Click OK.

What does this VIP do?

This VIP tells the FortiGate: when traffic arrives on port1 destined for port1-IP on port 8080, translate the destination to 10.10.10.100 on port 80.

Port forwarding is used here because it demonstrates DNAT clearly even without a physical internal server present. The mapping exists in the FortiGate configuration and you can verify it via CLI.

Getting a validation error on the external IP?

If the external IP field rejects your input, confirm you are entering port1's current DHCP-assigned IP. You can check this by running get system interface physical in the CLI Console and looking at the IP listed for port1.

Help me find port1's IP for the VIP external address.

Create a firewall policy for inbound VIP traffic

A VIP object alone does not allow traffic through. You must create a firewall policy that references the VIP as the destination. This policy controls which inbound traffic is permitted to reach the translated internal address.

  • Navigate to Policy & Objects, then Firewall Policy.
  • Click Create New.
  • In the Name field, enter Allow-Inbound-Web.
  • Set Incoming Interface to port1.
  • Set Outgoing Interface to port2.
  • Set Source to all.
  • Set Destination to VIP-WebServer (select your VIP object from the dropdown).
  • Set Service to ALL.
  • Set Action to ACCEPT.
  • Leave NAT disabled. The VIP handles destination translation. The policy NAT toggle is for Source NAT only.
  • Under Logging Options, enable Log Allowed Traffic and select All Sessions.
  • Click OK.

Why is NAT disabled on this policy?

The policy-level NAT toggle controls Source NAT only. Destination NAT (DNAT) is handled entirely by the VIP object you created. Enabling NAT here would add SNAT on top of the DNAT, which is not needed for inbound traffic reaching an internal server.

Why set Service to ALL instead of HTTP?

The port mapping is already handled by the VIP (external port 8080 maps to internal port 80). The VIP filters the port, so the policy service can be ALL without allowing unrestricted access. Only traffic matching the VIP's port forwarding rule reaches this policy.

You have now used all 3 firewall policy slots available on the trial license. Verify your complete configuration from the CLI.

  • Verify your VIP configuration by running this command in the CLI Console:
show firewall vip

You should see your VIP-WebServer entry with set portforward enable, the external port 8080, and the mapped port 80.

  • Verify all three firewall policies by running:
show firewall policy

You should see 3 policies listed: Deny-Social-Media, Allow-Outbound (with set nat enable), and Allow-Inbound-Web (with set dstaddr "VIP-WebServer").

Only seeing 2 policies in the output?

If the Allow-Inbound-Web policy does not appear, go back to the GUI and confirm you clicked OK (not Cancel) when creating it. Also verify you have not hit the 3-policy trial license limit by checking for a warning message when you tried to save.

Help me troubleshoot my missing firewall policy.

Secret mission

Trace Packets with diagnose debug flow

The diagnose debug flow command is one of the most frequently tested diagnostics on the NSE 4 exam. It shows you exactly how the FortiGate processes a packet: which policy it matches, whether NAT is applied, and where it gets forwarded or dropped. In this secret mission, you will trace live packets through your firewall and read the output like a network engineer.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely on your local machine using VMware Workstation and the FortiGate-VM trial license. There are no ongoing cloud costs or subscription charges to worry about.

Decide whether to keep your FortiGate-VM running, suspend it to come back later, or delete it entirely.

Resources you used:

  • FortiGate-VM in VMware Workstation (with trial license, firewall policies, VIP object, and interface configurations).

Keep everything running

No action needed. Choose this if you are still actively working through NSE 4 exam prep and want to continue experimenting with policies, NAT, and diagnostics.

  • Your FortiGate-VM stays powered on in VMware Workstation.
  • All firewall policies, VIP objects, and system settings remain intact.
  • The trial license does not expire, so there is no cost for keeping the VM running.

Pause - I'll come back to this later

Shut down the FortiGate-VM to free up system memory and CPU. Your configurations are saved to disk and will persist when you power the VM back on.

  • In the FortiGate CLI Console, run the shutdown command:
  • Alternatively, in VMware Workstation, click the VM name, then select VM in the menu bar, then Power and choose Shut Down Guest.
  • To resume later, open VMware Workstation and power the VM back on. Log in with username admin and the password you set during first boot.
execute shutdown

Delete - I don't want to use this again

Remove the FortiGate-VM and all associated files from your machine. This permanently deletes your firewall policies, VIP configurations, and system settings.

  • If you want to reset the FortiGate to factory defaults first (removing all configurations but keeping the VM), run this in the CLI Console:
execute factoryreset

What does this command do?

This resets the FortiGate to factory default settings. All firewall policies, VIP objects, interface configurations, and system settings are erased. The VM license is preserved unless you omit it.

  • To permanently delete the entire VM from your machine, power off the FortiGate-VM first.
  • In VMware Workstation, click the name of the FortiGate virtual machine.
  • In the Workstation menu bar, click Manage.
  • Select Delete from disk.
  • Click Yes to confirm.
  • Empty your Recycle Bin to reclaim the disk space used by the VM files.

This action is permanent

Deleting the VM removes all virtual disk files, configurations, and the trial license activation. If you want to redo this project later, you will need to redeploy a fresh FortiGate-VM and reactivate the trial license.

Nice Work!

Nice Work!

You just built a working FortiGate firewall lab from scratch, covering the two heaviest domains on the NSE 4 exam. You now have hands-on experience with firewall policies, Source NAT, and Destination NAT using Virtual IPs.

You've learned how to:

  • Configure a FortiGate-VM lab environment with interface configuration, trial license activation, and GUI/CLI access.
  • Create firewall policies demonstrating implicit deny, policy matching order, and Source NAT using the outgoing interface address.
  • Build a Virtual IP (VIP) for Destination NAT with port forwarding and a corresponding inbound firewall policy.
  • Secret Mission: Used diagnose debug flow to trace live packet processing through your firewall policies and identify policy matches.

Ready to quiz yourself?