---
name: licensed-firewall-configuring-fortigate
title: Configuring your FortiGate-VM firewall after deployment
description: After you log in to the FortiGate web console for the first time, the firewall is running with its default bootstrap configuration. The bootstrap configuration initializes the system settings that are required for IBM Cloud integration, but it does not include any firewall policies. No traffic is inspected or permitted through the firewall until you create policies.
last-updated: 2026-10-07
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/licensed-firewall?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Configuring your FortiGate-VM firewall after deployment
{: #configuring-fortigate}

After you log in to the FortiGate web console for the first time, the firewall is running with its default bootstrap configuration. The bootstrap configuration initializes the system settings that are required for IBM Cloud integration, but it does not include any firewall policies. No traffic is inspected or permitted through the firewall until you create policies.
{: shortdesc}

Before you make changes, review [Understanding the default firewall configuration](https://cloud.ibm.com/docs/licensed-firewall?topic=licensed-firewall-understanding-default-firewall-configuration&format=markdown) to understand what IBM applied during provisioning. Use the following information as a starting checklist for the configuration tasks you should complete before putting the firewall into production.

## Change the administrator password
{: #config-change-password}

The initial administrator password is displayed in your IBM Cloud Schematics workspace output and is visible to anyone with access to that workspace. Change it immediately on the first login.

1. Log in to the FortiGate web console.
1. In the upper-right, click the **admin** username and select **Change Password**.
1. Enter a strong, unique password and confirm it.
1. Click **OK**.

Store the new password in a secrets manager or password vault. Do not store it in plain text.
{: important}

## Verify the network interfaces
{: #config-verify-interfaces}

Confirm that the network interfaces reflect the IP addressing you configured during deployment. The bootstrap configuration pre-assigns IPs based on your Schematics input variables for HA deployments. Single VM deployments use DHCP.

1. Log in to the FortiGate web console.
1. Go to **Network > Interfaces**.
1. Verify that `port1` (public), `port2` (private), and (for HA deployments) `port3` (HA heartbeat) and `port4` (HA management) show the expected IP addresses and aliases.

For guidance on interface configuration, see the [FortiGate Administration Guide](https://docs.fortinet.com/product/fortigate/8.0){: external}.

## Update the IBM Cloud SDN Connector API key
{: #config-sdn-connector-api-key}

The IBM Cloud SDN Connector is pre-configured during deployment with the IBM Cloud API key that you provided. The SDN Connector uses this key to move floating IPs during failover events. If you rotate or change that API key outside of the firewall (for example, through IBM Cloud IAM), you must also update it in the SDN Connector, or failover stops working.

To update the API key in the SDN Connector:

1. Log in to the FortiGate web console.
1. Go to **Security Fabric > External Connectors**.
1. Double-click the **IBM Cloud** connector to open the **Edit External Connector** form.
1. Under **IBM Cloud Connector**, click **Change** next to the **API key** field.
1. Enter the new API key.
1. Click **OK** to save.

After saving, verify that the connector status shows as connected.

## Configure routing
{: #config-routing}

The FortiGate-VM requires static routes to direct traffic correctly between interfaces. At minimum, you need a default route on `port1` pointing to the public subnet gateway so that outbound internet traffic can flow, including license validation and FortiGuard updates.

For inter-subnet or internet-bound traffic to flow through the firewall, you must also update the VPC routing tables to send traffic to the FortiGate-VM's private interface (`port2`) as the next hop. For step-by-step instructions, see [Step 3: Route traffic through the firewall](https://cloud.ibm.com/docs/licensed-firewall?topic=licensed-firewall-access-firewall&format=markdown#access-firewall-routing).

For guidance on static route configuration on the FortiGate-VM itself, see the [FortiGate Administration Guide](https://docs.fortinet.com/product/fortigate/8.0){: external}.

## Create firewall policies
{: #config-firewall-policies}

The bootstrap configuration does not include any firewall policies. Without at least one allow policy, the FortiGate-VM drops all traffic that passes between interfaces, even if VPC routing is correctly configured.

Create firewall policies that match your traffic requirements. At minimum, consider:

- An outbound policy from `port2` (private) to `port1` (public) to allow workloads to reach the internet.
- An inbound policy from `port1` (public) to `port2` (private) for any services that you expose.
- Inter-subnet policies if you are routing traffic between VPC subnets through the firewall.

For step-by-step guidance on creating firewall policies, see the [FortiGate Administration Guide](https://docs.fortinet.com/product/fortigate/8.0){: external}.

## Enable security profiles
{: #config-security-profiles}

Attach security profiles to your firewall policies to activate threat inspection on traffic that is permitted through the firewall. The profiles available to you depend on your license plan.

For instructions on enabling Intrusion Prevention System (IPS), antivirus, web filtering, and application control, see [Enabling security services](https://cloud.ibm.com/docs/licensed-firewall?topic=licensed-firewall-enable-security-services&format=markdown).

## Adjust management access per interface
{: #config-management-access}

The default bootstrap configuration enables HTTPS, SSH, and ping on both `port1` and `port2`. Review and restrict these settings to match your operational requirements.

1. Log in to the FortiGate web console.
1. Go to **Network > Interfaces**.
1. Edit each interface and adjust **Administrative access** to allow only the protocols needed on that interface.
1. Click **OK** to save.

For security hardening recommendations, see [Security best practices for FortiGate on IBM Cloud VPC](https://cloud.ibm.com/docs/licensed-firewall?topic=licensed-firewall-fortigate-security-best-practices&format=markdown).

## Back up your initial configuration
{: #config-initial-backup}

After you complete your initial configuration, create a backup before the firewall enters production. This backup gives you a clean restore point.

For backup instructions, see [Backing up and restoring the FortiGate configuration](https://cloud.ibm.com/docs/licensed-firewall?topic=licensed-firewall-backup-restore-fortigate-config&format=markdown).

## Related links
{: #configuring-fortigate-related-links}

- [Understanding the default firewall configuration](https://cloud.ibm.com/docs/licensed-firewall?topic=licensed-firewall-understanding-default-firewall-configuration&format=markdown)
- [FortiGate Administration Guide](https://docs.fortinet.com/product/fortigate/8.0){: external}