Five FortiGate settings that are easy to review

FortiGates are solid firewalls, but a fresh deployment isn’t a hardened one. On a recent project, I validated a set of FortiGate configurations, and a pattern stood out: several simple security settings are off by default. If nobody deliberately turns them on, they stay off, sometimes for years.

Here are five settings I recommend reviewing on every FortiGate, all which ship disabled out of the box.

1. Pre-login banner

A pre-login banner displays a warning message before anyone authenticates to the device. It sounds cosmetic, but it serves a real purpose: it establishes legal notice that access is restricted to authorized users and that activity may be monitored. In some jurisdictions, prosecuting unauthorized access is harder without it.

FortiGate’s don’t show one by default. Enabling it takes seconds:

config system global
    set pre-login-banner enable
end

You can customize the message under the replacement messages settings to match your organization’s legal language.

2. Post-login banner

The companion setting, a banner displayed *after* successful login, is also disabled by default. This is your chance to remind administrators that they’re on a production security device, that changes are logged, and that they’re accountable for their session. It reinforces acceptable-use policy at exactly the moment someone is about to make changes.

config system global
    set post-login-banner enable
end

Together, the two banners cost you nothing operationally and check a box on nearly every compliance framework.

3. Disable USB firmware and configuration installation

By default, a FortiGate will accept firmware images and configuration files from a USB drive plugged into the device. Think about what that means: anyone with brief physical access to your firewall could potentially load their own configuration or firmware onto it.

Most organizations never use this feature, yet it stays enabled because nobody thinks about it. Turn it off:

config system auto-install
    set auto-install-config disable
    set auto-install-image disable
end

This is one of those settings that costs nothing to disable and closes off an entire physical attack vector.

4. Disable static keys for TLS

Static key ciphers in TLS don’t provide forward secrecy, if the server’s private key is ever compromised, previously captured traffic can be decrypted retroactively. Modern best practice is to rely on ephemeral key exchanges, and there’s rarely a legitimate reason to keep static key ciphers available on a security appliance.

FortiGates leave them enabled by default:

config system global
    set ssl-static-key-ciphers disable
end

If you have legacy clients that genuinely require static keys, that’s worth knowing about because those clients are a risk in themselves.

5. Log single CPU core overload events

This one is less about attack surface and more about visibility. A FortiGate can have plenty of overall CPU headroom while a single core is pinned at 100%, which can quietly degrade traffic handling for whatever processes are tied to that core. By default, the device won’t log this condition, so you may never know it’s happening.

config system global
    set log-single-cpu-high enable
end

Enabling it gives you early warning of performance problems that averaged CPU graphs will hide. When you’re troubleshooting intermittent latency or dropped sessions, this log entry can save you hours.

The bigger lesson

None of these settings are obscure or controversial and each takes under a minute to configure. The real takeaway is that “default” and “secure” aren’t the same thing, even on a dedicated security appliance. If you’ve never audited your FortiGate’s against a hardening baseline, these five settings are an easy place to start, and chances are, you’ll find at least a few of them still sitting at their factory defaults.