FortiGate NGFW Setup: Policies, VPN, and SSL Inspection

FortiGate NGFW Setup: Policies, VPN, and SSL Inspection Without Compromises

Imagine: you've configured policies, VPN works, but users complain about slowdowns. The cause is SSL inspection enabled without exceptions for streaming services. Our engineers have deployed such configurations for dozens of companies—from 50 to 5000 employees—and know where a beginner will stumble. Experience shows 80% of problems are solved by proper traffic distribution between NP-chip hardware acceleration and CPU. In one migration, we replaced old policies with profile-based ones, and CPU load dropped from 70% to 15%—simply by offloading checks to the NP6 processor.

Why standard policies don't work? Security without profiles is just an open port

In FortiOS, a firewall policy without a Security Profile linked is essentially permit any any, even if you specified IP and port. A Profile adds IPS, Application Control, Web Filter, and Antivirus. Without them, 70% of malicious traffic goes unnoticed. Example policy with profiles via FortiCLI:

config firewall policy
edit 100
set name "LAN-to-Internet"
set srcintf "LAN"
set dstintf "WAN1"
set srcaddr "LAN_SUBNET"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set utm-status enable
set ssl-ssh-profile "certificate-inspection"
set ips-sensor "default"
set application-list "default"
set webfilter-profile "default"
set logtraffic all
set nat enable
next
end

logtraffic all logs all sessions. In production, this can generate up to 50 GB of logs per day for 500 users, so after debugging we switch to logtraffic utm.

How to configure SSL Deep Inspection without blocking legitimate traffic?

SSL Deep Inspection turns FortiGate into a MiTM: the device decrypts HTTPS, inspects, and re-encrypts. Clients must trust the FortiGate CA certificate. Without it, certificate errors appear in every browser.

config vpn certificate local
    edit "fortigate-ca"
        set comments "FortiGate SSL Inspection CA"
    next
end
config firewall ssl-ssh-profile
    edit "deep-inspection"
        set comment "Full SSL/SSH inspection"
        config https
            set ports 443
            set status deep-inspection
        end
        set caname "fortigate-ca"
        set untrusted-caname "fortigate-ca"
    next
end

Distribute the CA via GPO (Windows) or MDM. Exemptions for banking sites and pinned resources are mandatory:

config firewall ssl-ssh-profile
    edit "deep-inspection"
        config ssl-exempt
            edit 1
                set type wildcard-fqdn
                set wildcard-fqdn "*.google.com"
            next
            edit 2
                set type wildcard-fqdn
                set wildcard-fqdn "*.apple.com"
            next
        end
    next
end

Setting up IPsec VPN: from dial-up to site-to-site

FortiGate acts as a concentrator for remote users. We use IKEv2 with aes256-sha256 and DH group 14. AD-based authentication reduces support tickets by 40%. IKEv2 is 2x faster than IKEv1 in tunnel re-establishment after disconnection—verified on 20+ projects.

config vpn ipsec phase1-interface
    edit "client-vpn"
        set type dynamic
        set interface "WAN1"
        set ike-version 2
        set peertype any
        set net-device enable
        set proposal aes256-sha256
        set dhgrp 14
        set psksecret "<PSK>"
        set ipv4-start-ip 10.10.20.1
        set ipv4-end-ip 10.10.20.100
        set ipv4-netmask 255.255.255.0
        set split-include-service "INTERNAL_NETWORKS"
    next
end
config vpn ipsec phase2-interface
    edit "client-vpn-p2"
        set phase1name "client-vpn"
        set proposal aes256-sha256
        set dhgrp 14
        set keylifeseconds 3600
    next
end

For AD authentication, configure LDAP and user group:

config user ldap
    edit "corp-ad"
        set server "192.168.1.10"
        set cnid "sAMAccountName"
        set dn "dc=corp,dc=company,dc=com"
        set type regular
        set username "cn=fortigate-bind,..."
        set password "<bind_password>"
    next
end
config user group
    edit "VPN-Users"
        set member "corp-ad"
        config match
            edit 1
                set server-name "corp-ad"
                set group-name "CN=VPN-Access,..."
            next
        end
    next
end

How to automate FortiGate policy management?

For infrastructure with dozens of devices, manual configuration is inefficient. We use the Ansible collection fortinet.fortios or the Terraform provider fortios. Configuration is stored in Git, undergoes code review, and is deployed via FortiManager. On one project, we automated policy deployment for 12 FortiGates—update time dropped from 4 hours to 15 minutes.

High Availability: Active-Passive cluster

For critical networks, always configure HA. Two FortiGates operate in Active-Passive mode with session and configuration synchronization. On failure, the passive device takes over in <1 second. Example CLI configuration:

config system ha
    set mode a-p
    set group-id 1
    set priority 200
    set override enable
    set monitor "port1" "port2"
end

We use a dedicated heartbeat link between devices. In production tested under 10 Gbps load—session interruption did not exceed 3 packets.

What's included in FortiGate setup? Deliverables

Typical mistakes when configuring FortiGate

• Missing SSL exemptions: without exemptions for banking and pinned resources, users cannot access sites with Certificate Pinning.
• Policy order: in FortiOS, first match determines action. Place more specific rules above general ones.
• Ignoring NP chips: if traffic is not offloaded to hardware acceleration, CPU overloads even at 100 Mbps.

Timelines and experience

We have configured FortiGates for 50+ projects—from small offices to distributed networks with 10,000 hosts. Full cycle from audit to handover—turnkey. Timelines depend on scope:

5+ years of experience with FortiGate—we've seen all typical mistakes: forgotten SSL exceptions, wrong policy order, overloaded CPUs without NP-chip usage. Get a consultation—we'll evaluate your configuration. Order a FortiGate audit—we'll find weaknesses and propose optimization.