Configure a rule to match the real traffic flow—its direction, interfaces, addresses, protocol or service, and schedule—then choose the action and check the rule’s position. On FortiGate, this is a firewall policy; in Cisco Firepower Management Center (FMC), it is an access-control rule inside an access-control policy. Neither product’s allow action replaces routing checks, and NAT is configured separately or through a distinct NAT path.
The steps and labels below are scoped to the vendor guides cited by name: FortiOS 7.4.4, 7.6.1, and 7.6.6, and Cisco FMC/FTD documentation for version 7.0, plus a Firepower 1100 FMC local-management example updated March 20, 2026. Menus and capabilities can differ by software release, appliance, and management method.
As an Amazon Associate I earn from qualifying purchases.
Start by defining the flow you intend to control
Before creating a policy, write down one representative connection. A useful flow description includes:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Source host or network and destination host or network.
- The interface or zone where the traffic enters and the interface or zone where it should leave.
- Protocol and destination port or service, if applicable.
- When the rule should apply, and whether the intended result is to allow, deny, or inspect the traffic.
A policy only applies when its match conditions describe the traffic. Fortinet’s FortiOS 7.6.6 Administration Guide puts the baseline plainly: “Any traffic going through a FortiGate unit has to be associated with a policy.” The practical implication is to scope the rule to the intended flow rather than copy a broad example such as all addresses and all services.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Configure a firewall policy on FortiGate
Create the policy in the FortiOS GUI
In the FortiOS 7.4.4 guide, the GUI path is Policy & Objects > Firewall Policy > Create New. Configure the policy fields to match the flow you documented:
- Give the policy a clear name that identifies its purpose.
- Select the incoming and outgoing interfaces for the traffic direction.
- Choose the source and destination address objects.
- Set the schedule and service or protocol/port scope.
- Choose the action, then save the policy.
The guide’s illustrative LAN-to-WAN example uses port1 to port2, Always, All, and Accept. Those values are examples, not safe defaults for every network: use only the interfaces, schedule, addresses, and services required for this connection.
Rank #2
- Extensive Connectivity Options: The FortiGate 60F is designed with 10 GE RJ45 ports, including 2 WAN ports, 1 DMZ port, and 7 internal ports, offering broad flexibility and high-density connections for diverse enterprise networking needs.
- Superior Performance for Secure Networks: Features powerful system-on-a-chip acceleration to deliver top-tier security with 1.4 Gbps IPS throughput and 700 Mbps threat protection throughput, ensuring effective defense against advanced threats.
- Enhanced SSL Inspection and SD-WAN Capabilities: Utilizes purpose-built security processor technology to provide the industry's highest SSL inspection performance and robust SD-WAN functionality for secure, high-speed network operations.
- Simple and Effective Management: Comes equipped with a user-friendly management console that supports comprehensive network automation and visibility, alongside Zero Touch Integration with Fortinet's Security Fabric for streamlined deployment.
- Advanced Security Features: Leverages continuous threat intelligence from AI-powered FortiGuard Labs, identifying and mitigating both known and unknown threats, enhancing security across all network traffic, whether encrypted or not.
Check policy sequence and the actual match
FortiGate offers policy views by sequence and by interface pair. In the FortiOS 7.6.1 guide, By Sequence shows the order in which policies are checked, and policies can be moved by policy ID. Review the sequence when a more general or earlier rule could match the same flow before the policy you intended to use.
The FortiGate policy lookup tool can check source interface, protocol, source and destination addresses, and ports. Fortinet’s guidance requires the relevant route to exist first; the lookup tool is unsupported in transparent mode. For a suspected mismatch, confirm the route, then compare the flow’s actual fields with the policy and its position.
Rank #3
- INTEGRATED FIREWALL APPLIANCE AND SECURITY SERVICES: Comes with FortiGate-40F Firewall Appliance, 1 year of FortiCare Premium, and FortiGuard Unified Threat Protection.
- UTP SECURITY FEATURES: Offers protection from advanced threats with DNS filtering, URL filtering, video filtering, and controls against botnets.
- IDEAL FOR SMALLER SETTINGS: Best suited for small to mid-sized businesses needing reliable security without the complexity of larger systems.
- CONTINUOUS SUPPORT AND MAINTENANCE: FortiCare Premium ensures that technical help is readily available to manage and troubleshoot issues.
- COMPACT AND EFFECTIVE: Provides a powerful, yet compact security solution that effectively protects against a wide range of cyber threats.
Keep FortiGate source NAT distinct from the access decision
Allowing traffic through a firewall policy and translating its source address are related tasks, but they are not the same decision. In the FortiOS 7.6.6 guide’s policy CLI example, source NAT is enabled with set nat enable. That per-policy option is not the only FortiGate arrangement: a device may instead use Central SNAT.
If the FortiGate uses Central SNAT
Fortinet documents Central SNAT as a separate configuration path. Its central SNAT table is read top-down and applied after the security policy. When central NAT is enabled, the per-policy IPv4 NAT option is skipped; source NAT must be configured in the central SNAT map. Check the device’s NAT mode and existing configuration before following instructions for either approach, rather than enabling or creating a second path by assumption.
Rank #4
- Single appliance with integrated firewalling, SD-WAN and Wi-Fi controller reduces complexity of WLAN management. Its zero-touch deployment helps optimize your onboarding experience.
- Built on a patented secure processor, this compact network firewall delivers the highest level of security and performance in its class – 800 Mbps IPS | 500 Mbps threat protection.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact and fanless design equipped with 4 GE RJ45 ports (1 WAN port and 3 internal ports) provide essential connectivity and flexibility for various network configurations in a small-scale environment.
- Fortinet is the most deployed and trusted firewall from businesses worldwide with 99.98% security effectiveness, surpassing competition. Fortinet is the only vendor recognized as a firewall leader 13 consecutive years by Gartner.
Account for VIP-backed policies when troubleshooting denies
Fortinet documents a special case for policies using virtual IP (VIP) objects: a deny policy intended to block traffic for a VIP-backed accept policy should have match-vip enabled and be ordered to match before that accept policy. In the documented FortiOS 7.6.6 case, new deny policies enable this setting by default. This exception means ordinary policy-order checks alone may not explain a VIP-related result.
Configure access control in Cisco Firepower Management Center
Cisco FMC calls the rules access-control rules; they belong to an access-control policy. Do not treat this policy as a FortiGate firewall policy under a different menu name. In the Cisco FMC 7.0 guide, administrators set rule order, and in most cases the first rule whose conditions match determines handling.
Best Value
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Build and position an access-control rule
- In the FMC access-control policy used by the relevant managed device, add a rule and define its traffic conditions to match the intended source, destination, and service or other criteria available in that release.
- Choose the required action: monitor, trust, block, or allow.
- Place the rule in the intended order relative to rules whose conditions may overlap.
- Review any inspection settings associated with an allow rule before applying the policy through the management workflow for your installation.
An allow action means the access-control decision permits traffic to proceed through that stage; it does not necessarily mean the traffic bypasses inspection. Cisco’s FMC 7.0 documentation says an allow rule can apply intrusion or file inspection before traffic reaches assets or leaves the network.
These terms and behaviors refer to FMC-managed access control. Cisco also documents Firepower Threat Defense Device Manager (FDM); its screens and workflow should not be assumed to match FMC. Use the guide for the installed FTD release and management plane rather than copying menus from another setup.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Configure Cisco FTD NAT separately
FTD address translation uses a NAT policy with its own ordered table; it is not the access-control rule order. Cisco’s FTD NAT guide describes three table sections, evaluated in order—section 1, then section 2, then section 3—until a match is found. Manual NAT rules in section 1 are evaluated in their configured order, so place a specific overlapping rule before a more general one. Cisco recommends keeping NAT rules simple and planning their order carefully.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Example: outbound interface PAT in a scoped FMC workflow
A Cisco Firepower 1100 FMC local-management quick-start guide, updated March 20, 2026, provides one concrete outbound example: create a NAT policy, add a dynamic Auto NAT rule, choose the outside zone, select the original source network object, and translate the source to the destination interface IP for interface PAT. This is an FMC/local-management example for that guide’s scope, not a universal menu path for FDM or every FTD version.
How the two policy systems differ
| Configuration concern | FortiGate / FortiOS | Cisco Firepower / Secure Firewall Threat Defense |
|---|---|---|
| Access-rule vocabulary | Firewall policy | Access-control rule in an access-control policy (FMC terminology) |
| Access-rule ordering | Sequence view exposes policy check order; policies can be moved by policy ID in the FortiOS 7.6.1 guide. | FMC administrators configure order; usually the first matching rule determines handling, per the FMC 7.0 guide. |
| NAT configuration | Source NAT may be enabled on an IPv4 policy or configured through Central SNAT, depending on device configuration. | Separate NAT policy and table; table sections and rule order govern NAT matching. |
| Scope of the cited procedures | GUI example: FortiOS 7.4.4; sequence and lookup guidance: 7.6.1; NAT and VIP guidance: 7.6.6. | Access-control and NAT behavior: Cisco FMC/FTD documentation version 7.0; outbound PAT example: Firepower 1100 FMC local-management guide updated March 20, 2026. |
Troubleshoot a rule that does not behave as expected
- Describe the observed flow precisely. Record the actual source, destination, ingress and egress interface or zone, protocol and ports, and time window.
- Confirm routing. On FortiGate, the documented policy lookup workflow requires the relevant route. A rule cannot fix an incorrect or missing route.
- Check the access-rule match and order. On FortiGate, use policy lookup where supported and inspect the By Sequence view. In FMC, inspect the first matching access-control rule and its action or inspection configuration.
- Inspect translation separately. On FortiGate, determine whether source NAT is per-policy or Central SNAT. On FTD, review the NAT table’s section and rule order separately from access control.
- Apply the VIP exception when relevant. For a FortiGate VIP-backed accept policy, inspect
match-vipand deny-rule placement as described above.
Before changing a deployed policy, verify address and service objects and follow the organization’s change-control process. Vendor instructions cited here cover particular software versions and management methods; confirm the matching guide for the device actually in use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
