#3 - Initial Setup of FortiGate in EVE-NG / PNETLab (Management Interface + Internet Access)

In this guide, we will walk through the initial configuration of a FortiGate appliance running in a lab environment using EVE-NG or PNETLab. The goal is to establish management access, enable internet connectivity, and allow traffic through the firewall.

Lab Environment

Platform: EVE-NG / PNETLab
Image: FortiGate v7.0.3 (build 0237)
CPU: 1 vCPU
RAM: 2048 MB

Step 1 - First CLI Access

Access the FortiGate via the console using:

Username: admin
Password: (leave blank)

On the first login, you will be prompted to set a new password. This is mandatory before proceeding.

Step 2 - Configure the Management Interface

To simplify access to the device, we connect one interface (in this example, port4) to a Cloud (bridge) network in EVE-NG/PNETLab. This allows direct access from your local machine without needing an additional VM.

Configuration

Access the device CLI via terminal and run:

config system interface
    edit port4
        set ip 192.168.0.X/24
        set allowaccess http https ssh ping
        set alias "GERENCIA"
        set role lan
    next
end

Replace 192.168.0.X with an available IP in your local network
The allowaccess parameter enables management protocols
The alias is optional but helps identify the interface
The role defines the interface behavior as LAN

Connectivity Test

execute ping 192.168.0.1

If configured correctly, the device should be able to reach your local gateway.

Step 3 - Configure Default Gateway

To allow external connectivity (internet access), configure a default route:

config router static
    edit 1
        set gateway 192.168.0.1
        set device "port4"
    next
end

Test External Connectivity

execute ping 8.8.8.8

At this stage, the ping may fail. This is expected because FortiGate requires firewall policies to allow traffic.

Step 4 - Configure DNS

DNS configuration is required for name resolution and proper communication with external services.

config system dns
    set primary 1.1.1.1
    set secondary 1.0.0.1
end

Test Name Resolution

execute ping google.com

At this stage, the ping may fail. This is expected because FortiGate requires firewall policies to allow traffic.

Step 5 - Configure Firewall Policy (Required)

FortiGate is a firewall and requires explicit policies to allow traffic.

config firewall policy
    edit 1
        set name "GERENCIA_to_Internet"
        set srcintf "port4"
        set dstintf "port4"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
end

This policy allows traffic to pass through the firewall and enables NAT for internet access.

Test Connectivity Again

execute ping 8.8.8.8
execute ping google.com

If configured correctly, both tests should now succeed.

Step 6 – Access via Web Interface and Licensing

Now you can access the FortiGate GUI from your browser:

https://192.168.0.X

Once authenticated, your lab device will automatically receive a trial license, allowing you to explore features for learning and testing purposes.

Final Notes

Ensure your EVE-NG/PNETLab cloud interface is properly bridged to your host network
Avoid IP conflicts with other devices on your LAN
If connectivity fails, verify interface configuration, routing, and firewall policies

Unlike FortiAnalyzer, FortiGate requires firewall policies and NAT to allow traffic, which is a key concept when working with security appliances.

This setup provides a clean and efficient way to manage your FortiGate directly from your local machine while enabling full internet access for testing and learning.

***GERENCIA = Management

Table of Contents