FortiGate policy baseline

config system global
    set hostname "fw-01"
    set admin-sport 8443
end

config firewall address
    edit "lan-net"
        set subnet 10.70.0.0 255.255.255.0
    next
    edit "admin-net"
        set subnet 10.70.99.0/24
    next
end

config firewall policy
    edit 1
        set name "lan-to-internet"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "lan-net"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
        set logtraffic all
    next
end

# Restrict management to a known subnet — trusthost is evaluated before
# authentication, so it holds even if a password leaks.
config system admin
    edit "admin"
        set trusthost1 10.70.99.0/24
    next
end