Change the administrator password

The initial administrator password is displayed in your IBM Cloud Schematics workspace output and is visible to anyone with access to that workspace. Change it immediately on the first login.

1. Log in to the FortiGate web console.
2. In the upper-right, click the admin username and select Change Password.
3. Enter a strong, unique password and confirm it.
4. Click OK.

Store the new password in a secrets manager or password vault. Do not store it in plain text.

Verify the network interfaces

Confirm that the network interfaces reflect the IP addressing you configured during deployment. The bootstrap configuration pre-assigns IPs based on your Schematics input variables for HA deployments. Single VM deployments use DHCP.

1. Log in to the FortiGate web console.
2. Go to Network > Interfaces.
3. Verify that port1 (public), port2 (private), and (for HA deployments) port3 (HA heartbeat) and port4 (HA management) show the expected IP addresses and aliases.

For guidance on interface configuration, see the FortiGate Administration Guide.

Update the IBM Cloud SDN Connector API key

The IBM Cloud SDN Connector is pre-configured during deployment with the IBM Cloud API key that you provided. The SDN Connector uses this key to move floating IPs during failover events. If you rotate or change that API key outside of the firewall (for example, through IBM Cloud IAM), you must also update it in the SDN Connector, or failover stops working.

To update the API key in the SDN Connector:

1. Log in to the FortiGate web console.
2. Go to Security Fabric > External Connectors.
3. Double-click the IBM Cloud connector to open the Edit External Connector form.
4. Under IBM Cloud Connector, click Change next to the API key field.
5. Enter the new API key.
6. Click OK to save.

After saving, verify that the connector status shows as connected.

Configure routing

The FortiGate-VM requires static routes to direct traffic correctly between interfaces. At minimum, you need a default route on port1 pointing to the public subnet gateway so that outbound internet traffic can flow, including license validation and FortiGuard updates.

For inter-subnet or internet-bound traffic to flow through the firewall, you must also update the VPC routing tables to send traffic to the FortiGate-VM's private interface (port2) as the next hop. For step-by-step instructions, see Step 3: Route traffic through the firewall.

For guidance on static route configuration on the FortiGate-VM itself, see the FortiGate Administration Guide.

Create firewall policies

The bootstrap configuration does not include any firewall policies. Without at least one allow policy, the FortiGate-VM drops all traffic that passes between interfaces, even if VPC routing is correctly configured.

Create firewall policies that match your traffic requirements. At minimum, consider:

• An outbound policy from port2 (private) to port1 (public) to allow workloads to reach the internet.
• An inbound policy from port1 (public) to port2 (private) for any services that you expose.
• Inter-subnet policies if you are routing traffic between VPC subnets through the firewall.

For step-by-step guidance on creating firewall policies, see the FortiGate Administration Guide.

Enable security profiles

Attach security profiles to your firewall policies to activate threat inspection on traffic that is permitted through the firewall. The profiles available to you depend on your license plan.

For instructions on enabling Intrusion Prevention System (IPS), antivirus, web filtering, and application control, see Enabling security services.

Adjust management access per interface

The default bootstrap configuration enables HTTPS, SSH, and ping on both port1 and port2. Review and restrict these settings to match your operational requirements.

1. Log in to the FortiGate web console.
2. Go to Network > Interfaces.
3. Edit each interface and adjust Administrative access to allow only the protocols needed on that interface.
4. Click OK to save.

For security hardening recommendations, see Security best practices for FortiGate on IBM Cloud VPC.

Back up your initial configuration

After you complete your initial configuration, create a backup before the firewall enters production. This backup gives you a clean restore point.

For backup instructions, see Backing up and restoring the FortiGate configuration.

Related links

• Understanding the default firewall configuration
• FortiGate Administration Guide