Security best practices for FortiGate-VM on IBM Cloud VPC

Follow these security best practices to reduce the attack surface of your FortiGate-VM deployment, protect management access, and maintain a strong security posture throughout the lifecycle of your firewall.

Restrict management access through the security group

Every FortiGate-VM deployment creates two dedicated security groups — one for the public interface and one for the private interface. Both include restrictive pre-configured inbound rules that allow the instance to download the license and enable cluster synchronization. They do not permit management access and must not be removed.

The public security group also restricts outbound (egress) traffic for all three FortiGate-VM offerings to only what is required for Fortinet services:

  • UDP 53 — FortiGuard DNS and SDNS queries
  • TCP 443 — Licensing, FortiCare, and entitlements
  • TCP 8890 — FortiGuard distribution updates

When you open management access, follow these principles:

  • Allow only your administrator IP addresses. Add inbound TCP rules for port 443 (HTTPS) or port 22 (SSH) with a specific source IP address or CIDR range. Do not use 0.0.0.0/0 as the source.
  • Use the narrowest CIDR possible. If your administrators connect from a known IP range, restrict the source to that range only.
  • Separate management access from data plane traffic. If possible, access the FortiGate management interface from a dedicated management subnet or through a VPN, rather than directly over the public floating IP.
  • Review the security group rules regularly. Remove any inbound rules that are no longer needed, such as rules added for temporary access.

For step-by-step instructions, see Accessing your FortiGate firewall.

Change the default administrator password immediately

The initial administrator password is generated at deployment time and is displayed in the IBM Cloud Schematics workspace output. This password is visible to anyone with access to the Schematics workspace.

  • Change the administrator password the first time that you log in to the FortiGate web console.
  • Use a strong, unique password that is not shared with other systems.
  • Store the password in a secrets manager or password vault rather than in plain text.

Disable unused management protocols on each FortiGate-VM interface

Within the FortiGate-VM itself, the default bootstrap configuration enables HTTPS, SSH, and ping on both port1 and port2. This is independent of the IBM Cloud security group, which controls traffic at the VPC network layer. For additional hardening, you can use the FortiGate web console to disable any management protocols on each interface that are not required for your operational workflow.

  1. Log in to the FortiGate web console.
  2. Go to Network > Interfaces.
  3. Edit port1 and port2.
  4. In Administrative access, clear any protocols that are not in use.
  5. Click OK to save.

Leaving ping (PING) enabled on the public interface (port1) allows external hosts to probe the firewall's presence. Disable it if internet-facing discovery is a concern.

Use a VPN or bastion host for management access

Where possible, avoid exposing the FortiGate management interface directly on the public floating IP. Instead:

  • Deploy a VPN termination point or a bastion host in your VPC.
  • Access the FortiGate management interface from within the VPC over a private IP address.
  • Restrict the management security group rule to the VPN or bastion host source IP only.

This approach eliminates direct internet-facing management access entirely.

Keep FortiOS firmware up to date

Running a supported and patched firmware version is one of the most effective defenses against known vulnerabilities.

  • Subscribe to Fortinet PSIRT advisories to be notified of new vulnerabilities. For more information, see Keeping abreast of firmware updates and vulnerability patches.
  • Review the FortiGate-VM release notes before you upgrade to understand any behavior changes.
  • Schedule firmware upgrades during a maintenance window. The FortiGate-VM restarts during an upgrade.
  • For HA deployments, follow Fortinet recommended upgrade sequence to minimize downtime.

Enable logging for all firewall policies

Ensure that traffic logging is enabled on your firewall policies, especially for allowed traffic. Without logging, you have no record of what traffic passed through the firewall.

  1. Log in to the FortiGate web console.
  2. Go to Policy & Objects > Firewall Policy.
  3. Edit each policy and ensure that Log Allowed Traffic is set to All Sessions or at minimum Security Events.
  4. Click OK to save.

Apply security profiles to internet-facing policies

For any firewall policy that allows traffic from the internet or to untrusted networks, attach security profiles to inspect the traffic:

  • IPS — Detects and blocks known attack patterns.
  • Antivirus — Scans file transfers for malware.
  • Web filtering — Controls access to website categories (UTP and Enterprise tiers).
  • Application control — Identifies and enforces policy on applications (UTP and Enterprise tiers).

For instructions, see Enabling security services.

Limit administrator accounts and use role-based access

  • Do not share the admin account between multiple administrators. Create named administrator accounts with the minimum privileges required for each role.
  • Use read-only profiles for monitoring accounts.
  • Review administrator accounts periodically and remove accounts that are no longer needed.

Back up your configuration regularly

IBM does not back up your FortiGate-VM configuration. You are responsible for maintaining backups.

  • Export the configuration from the FortiGate web console on a regular schedule. For step-by-step instructions, see Backing up and restoring the FortiGate configuration.
  • Store the backup securely and off the FortiGate-VM instance (for example, in IBM Cloud Object Storage).
  • Test configuration restore procedures before you need them in production.
  • Do not use IBM Cloud VPC volume snapshots or whole-volume backups for firewall recovery. Use FortiGate .conf export and restore procedures instead. For more information, see Unsupported backup methods.