#5 - Initial Setup of FortiManager in EVE-NG / PNETLab (Management Interface + Internet Access)

In this guide, we will walk through the initial configuration of a FortiManager appliance running in a lab environment using EVE-NG or PNETLab. The goal is to establish management access, enable internet connectivity, and prepare the device for FortiGuard services and general lab use.

Lab Environment

• Platform: EVE-NG / PNETLab
• Image: FortiManager v7.0.3 (build 0254)
• CPU: 4 vCPU
• RAM: 8192 MB

Step 1 - First CLI Access

Access the FortiManager via the console using:

Username: admin
Password: (leave blank)

On the first login, you will be prompted to set a new password. This step is mandatory before proceeding.

Step 2 - Configure the Management Interface

To simplify access to the device, connect one interface, in this example port4, to a Cloud (bridge) network in EVE-NG or PNETLab. The bridge must terminate on an isolated, trusted management segment that is reachable only from your administration host. Do not attach this interface to a shared LAN, untrusted Wi-Fi network, or any publicly exposed network.

Configuration

Access the device CLI and run:

config system interface
    edit port4
        set ip 192.168.0.X/24
        set allowaccess https ssh ping
        set alias "GERENCIA"
    next
end

Replace 192.168.0.X with an available IP address in your local network.

• The allowaccess parameter enables encrypted HTTPS and SSH management plus ICMP diagnostics. Cleartext HTTP management remains disabled.
• The alias parameter is optional, but it helps identify the interface.
• Keep this address on the isolated management segment and restrict administrator trusted hosts to the administration workstation or subnet.

Connectivity Test

execute ping 192.168.0.1

If configured correctly, the device should be able to reach your local gateway.

Step 3 - Configure the Default Gateway

To allow external connectivity, configure a default route:

config system route
    edit 1
        set gateway 192.168.0.1
        set dst 0.0.0.0/0
        set device "port4"
    next
end

Test External Connectivity

execute ping 8.8.8.8

A successful response confirms basic internet connectivity.

Step 4 - Configure DNS

DNS configuration is required for name resolution and proper communication with FortiGuard services.

config system dns
    set primary 1.1.1.1
    set secondary 1.0.0.1
end

Test Name Resolution

execute ping google.com

If this works, DNS is correctly configured.

Step 5 – Access via Web Interface and Licensing

Now you can access the FortiManager GUI from your browser:

https://192.168.0.X

Log in using your FortiCloud account credentials:

👉 https://www.forticloud.com

Once authenticated, your lab device will automatically receive a trial license, allowing you to explore features for learning and testing purposes.

Step 6 - Keep Strong SSL Security Settings

Do not lower the SSL/TLS security level to work around communication problems in EVE-NG or PNETLab. In particular, do not enable SSLv3 or low-encryption cipher suites. Keep the Fortinet defaults aligned with the documented encryption best practices:

config system global
    set enc-algorithm high
    set fgfm-ssl-protocol tlsv1.2
    set ssl-low-encryption disable
end

If integration still fails, verify the appliance versions, clock, certificates, registration, and connectivity. Upgrade or align the lab images instead of weakening the protocol or cipher configuration.

Final Notes

• Ensure your EVE-NG or PNETLab cloud interface is bridged only to the isolated management segment.
• Avoid IP conflicts with other devices on your LAN.
• If ping tests fail, verify your bridge configuration, interface settings, and gateway.
• This setup provides a simple and efficient way to manage your FortiManager directly from your local machine.

GERENCIA = Management