Six essential capabilities
Firewall policies
Traffic matching, allow and deny
Address translation
Source or destination translation
Encrypted tunnels
Site-to-site or remote access
Intrusion prevention
Signature-based threat detection
Network segmentation
Separate networks and zones
Visibility
Events, sessions and diagnostics
Simple definition
FortiGate is Fortinet’s firewall platform running FortiOS to secure, filter, and route network traffic.
Technical definition
A FortiGate combines stateful firewalling, routing, NAT, and VPN capabilities and, depending on the model, licensing, and configuration, advanced inspection and security features. Traffic is processed according to interfaces, routing, firewall policies, translation, and the security profiles that apply.
- Client / VLAN Source address and service
- Routing Interface and destination
- Firewall policy Allow or deny
- NAT and inspection Based on enabled profiles
- Internet / server Session and logs
Actual processing depends on FortiOS version, existing sessions, NAT mode and configured security profiles.
How it works / role
Its role is to control communication between network zones and the Internet, establish VPN tunnels, enforce access rules, and provide a central point for network visibility and security.
What is it used for?
Protect a site, segment VLANs, connect branches through VPN, publish services, control Internet access, or participate in an SD-WAN design.
Practical example
A company places a FortiGate between its LAN and the Internet. User and server VLANs use separate policies, outbound traffic is NATed, and branch offices connect through IPsec tunnels.
Common issues
- Missing firewall policy or incorrect policy order
- Incorrect route or interface
- Misconfigured NAT or address object
- Security inspection blocks or alters legitimate traffic
FortiGate architecture and FortiOS
FortiGate is a Fortinet network security appliance running FortiOS. Depending on model and licensing, it combines stateful firewalling, NAT, routing, VPN, SD-WAN and security inspection. Physical interfaces, VLANs and zones organize traffic. A firewall policy defines source, destination, services, interface or zone, schedule and action, with optional NAT and inspection profiles. NP/CP hardware acceleration can optimize supported flows, but behavior depends on the platform and enabled features.
Firewall policies and matching order
FortiOS evaluates firewall policies against packet context, including incoming and outgoing interfaces, addresses and services. Policy order matters: an overly broad allow rule may shadow a later restrictive rule. Established flows are tracked in sessions, so a policy change may not immediately affect existing connections. Use named address objects, narrowly defined services and appropriate logging to identify the rule permitting or denying a connection.
NAT, VIPs and service publishing
Source NAT commonly translates outbound source addresses, including traffic sharing a public IP. Destination NAT changes the destination, for example through a Virtual IP (VIP) publishing an internal service. FortiGate NAT behavior depends on configuration, including Central SNAT mode. Defining a VIP alone is not sufficient: appropriate firewall policy, routing, a listening service and security controls are also required. Broad inbound rules unnecessarily increase exposure.
VLANs, routing and segmentation
A FortiGate can handle separate networks through physical or VLAN subinterfaces, each with IP addressing and traffic rules. Routing selects the next hop while firewall policy permits or denies flows: an existing route does not mean traffic is allowed. Across multiple sites, static or dynamic routes and VPN selectors must align with subnets and NAT design. Avoid mixing users, guests and servers into one unrestricted trust zone without documented segmentation.
IPsec VPN, remote access and MFA
IPsec tunnels connect sites or clients using IKE negotiation and security associations. Encryption suites, authentication, key exchange, traffic selectors and routes must be compatible across peers. Remote-access features differ by FortiOS release and model: verify the installed branch before selecting SSL VPN or IPsec. Apply MFA, individual accounts, limited destination access and logging. Avoid granting every remote user unrestricted access to the internal network.
SD-WAN and multiple Internet links
FortiGate SD-WAN groups transport members and uses rules to steer traffic according to requirements. Performance SLA health checks can measure reachability, packet loss, jitter and latency to influence link selection. An available connection may still be poor for VoIP, so policies can prefer a link meeting quality thresholds. Actual failover also depends on routing, NAT, session state and destination behavior. Test both physical outages and partial performance degradation.
Security profiles and TLS inspection
Antivirus, IPS, Web Filter, DNS Filter and Application Control profiles add controls to policies referencing them. Inspection depth depends on protocol and TLS handling; certificate inspection does not expose the same content as full deep inspection. TLS interception may require a trusted CA on managed endpoints and introduces privacy, performance and compatibility concerns, particularly for certificate-pinned applications. Roll out blocking gradually and analyze false positives and logs.
High availability and monitoring
Compatible FortiGate devices can form an HA cluster according to the chosen mode and physical design. Heartbeat links, monitored interfaces, configuration synchronization and failover criteria require planning. HA does not protect against a misconfigured policy synchronized to both members. Monitor local or centralized logs, tunnel state, resource usage, SD-WAN health, licensing and firmware lifecycle. FortiAnalyzer can assist with event correlation depending on deployment.
Troubleshooting: isolate a failed flow
Before changing configuration, identify source and destination IPs, protocol, port, ingress interface and intended path. Then check addressing, routing, matching firewall policy, NAT and session state. FortiOS flow diagnostics and packet captures can expose decisions, but exact commands and options vary by release. Use narrowly targeted filters for short periods on production devices. For VPNs, examine IKE negotiation, selectors, routes and policies separately. A successful ping does not prove that a TCP or UDP service is reachable.
Hardening, backups and upgrades
Restrict management access to necessary interfaces and source addresses; use named, least-privilege administrator identities and MFA where supported. Protect and back up configuration files and document changes before upgrades. Review Fortinet security advisories, feature compatibility and the recommended upgrade path for the installed FortiOS release: direct version jumps are not always supported. Test VPNs, VLANs, NAT, logging and WAN failover afterward. Secure physical access, emergency accounts and secrets contained in configuration backups.
Related terms
Key takeaway: A useful FortiGate diagnosis follows the actual packet path: ingress interface, routing, firewall policy, NAT, security inspection, and egress interface.