Fortinet Pod with Win 10

Use the included Windows 10 client to reach the FortiGate web admin GUI — full FortiOS dashboard without leaving the lab.

~15 min to first packet through the firewall 7 nodes, ~13 GB RAM at peak Last verified 2026-06-20

0What you'll do

Boot FortiGate v7.6.2 and complete the CLI first-time setup
Use the included Win 10 client to browse to the FortiGate web admin at https://<fgt-mgmt-ip>
Configure WAN (port1) and LAN (port2) interfaces with zones
Push a default LAN→WAN allow + NAT policy and verify ping from R2

1Boot order

Start FortiGate — fast (~4 min to FortiGate-VM64-KVM login:).
Start IOL routers/switches (instant).
Start the Win 10 client last.

2First-time CLI setup on FortiGate

Open the FortiGate console (telnet). Default login:

username: admin
password: (just press Enter — blank by default)

Set the admin password and Mgmt interface (typically port1 = WAN, but we'll use port1 for Mgmt too in the lab):

config system admin
  edit admin
    set password NhFgt1!
  next
end

config system interface
  edit port1
    set mode static
    set ip 192.168.10.10 255.255.255.0
    set allowaccess ping https ssh http
    set alias Mgmt
  next
end

config system dns
  set primary 1.1.1.1
end

config router static
  edit 1
    set gateway 192.168.10.1
    set device port1
  next
end

FortiOS evaluates each end as a commit. No separate commit step like PAN-OS.

3Reach the GUI from Win 10

Open the Win 10 VNC console.
Confirm Win 10's NIC has an IP on the Mgmt subnet (DHCP via the Mgmt bridge or static 192.168.10.30 / 24).
Open Edge. Browse to https://192.168.10.10.
Accept the self-signed cert warning.
Log in as admin / NhFgt1!.

First time you log in, FortiOS will ask you to take a short tour and may show a license-expired banner (eval VM). Dismiss both — full GUI access is preserved for lab purposes.

4Configure WAN + LAN interfaces in the GUI

Network → Interfaces:

Interface	Role	IP/Mask	Access
port1 (already set)	Mgmt	192.168.10.10/24	https ssh ping
port2	WAN	198.51.100.1/24	ping
port3	LAN	10.10.10.1/24	ping https

Edit each from the GUI: assign role, set static IP, enable DHCP on LAN if you like.

5Add the LAN→WAN policy with NAT

Policy & Objects → Firewall Policy → Create New:

Field	Value
Name	LAN-to-WAN
Incoming Interface	port3 (LAN)
Outgoing Interface	port2 (WAN)
Source	all
Destination	all
Service	ALL
Action	ACCEPT
NAT	Enabled (use outgoing interface address)

Save. No separate commit needed.

6Verify from R2 (LAN side)

Open the R2 telnet console:

enable
configure terminal
interface Ethernet0/0
 ip address 10.10.10.10 255.255.255.0
 no shutdown
ip route 0.0.0.0 0.0.0.0 10.10.10.1
end
ping 198.51.100.254 source Ethernet0/0

Reply success ⇒ traffic is going R2 → FortiGate (LAN) → NAT → R1 (WAN). Confirm in the GUI: Log & Report → Forward Traffic — your ICMP flow shows up with action accept.

7Troubleshooting

Symptom	Check
Browser shows "connection refused"	HTTPS access disabled on port1. Re-run `set allowaccess ping https ssh` from CLI.
Browser hangs forever	Wrong Mgmt IP, or port1 link is down. CLI: `get system interface physical`.
Policy added but ping fails	NAT not enabled on the policy, or no default route on R2. Check Network → Static Routes on FGT.
"Configuration not synchronized"	You're in HA mode by accident. `get system ha` → set mode `standalone`.
License banner blocks features	Expected on eval. Most labs work fine; only signature-based services (IPS, AV) need a paid license.