Cannot Access FortiGate Web GUI / Admin Interface

Step 1 — Check Interface HTTPS Access Is Enabled

The most common cause of being unable to reach the FortiGate GUI is that HTTPS administrative access is not enabled on the interface you're connecting from. Each FortiGate interface has an allowaccess setting that controls which services (HTTPS, HTTP, SSH, PING, etc.) are permitted on that interface.

If you still have SSH or console access, check the interface settings:

show system interface

Look for your management interface (commonly mgmt, port1, or internal). Confirm https appears in the allowaccess list. If not, add it:

config system interface
    edit "port1"
        set allowaccess ping https ssh
    next
end

Also confirm the admin HTTPS port hasn't been changed from the default (443). Check with:

show system global | grep admin-port

If the port was changed (e.g., to 8443), connect using https://<IP>:8443 instead. To restore it to 443:

config system global
    set admin-port 443
    set admin-sport 443
end

Step 2 — Trusted Hosts Locking You Out

FortiGate admin accounts can be restricted to specific source IP addresses using the Trusted Hosts setting. If your IP address has changed (e.g., after an ISP change, connecting from a different office, or working from home), you will be silently blocked — the GUI won't load, or you'll get a connection refused/timeout.

To check trusted host restrictions on admin accounts via CLI:

show system admin

Look for set trusthost1, set trusthost2, etc. under your admin account. If your current IP is not in these ranges, you'll be blocked. To remove the trusted host restriction (allows admin from any IP — tighten this again after access is restored):

config system admin
    edit "admin"
        set trusthost1 0.0.0.0 0.0.0.0
    next
end

Step 3 — Admin Account Lockout

FortiGate can lock an admin account after repeated failed login attempts. The lockout duration is configured in system settings. If your account is locked, wait for the lockout period to expire, or unlock it from another admin account or via console:

diagnose sys top

To check and clear an admin lockout (requires console or another admin session):

diagnose debug reset
execute disconnect-admin-session <admin-name>

To check the admin lockout threshold and duration settings:

show system global | grep lockout

You'll see values like admin-lockout-threshold (number of failed attempts) and admin-lockout-duration (seconds). To increase the lockout threshold or disable it temporarily:

config system global
    set admin-lockout-threshold 10
    set admin-lockout-duration 60
end

Step 4 — Using Serial Console as Fallback

If you cannot access the GUI or SSH, the serial console port is your recovery path. All FortiGate units have a physical console port (RJ-45 or DB-9 depending on model). Connect with a console cable and terminal emulator (PuTTY on Windows, screen on Linux/macOS).

Console settings for FortiGate:

• Baud rate: 9600
• Data bits: 8
• Parity: None
• Stop bits: 1
• Flow control: None

On macOS/Linux, find the console device and connect:

ls /dev/tty.usb*
screen /dev/tty.usbserial 9600

On Windows, use PuTTY: Connection type = Serial, Speed = 9600, Serial line = COM3 (check Device Manager for correct COM port).

Once connected, log in with your admin credentials. From here you can run all the CLI commands in this guide, including fixing trusted hosts, enabling HTTPS on interfaces, or resetting admin passwords.

Step 5 — Resetting Admin Password via Maintainer Account

If you've lost the admin password entirely and cannot log in, FortiGate has a maintainer account that can be used during the boot sequence. This requires physical console access.

1. Connect via serial console as described above.
2. Reboot the FortiGate: execute reboot
3. Watch the console output during boot. When you see the login prompt appear (within the first 30–60 seconds after boot completes), immediately type maintainer as the username.
4. The password is bcpb followed immediately by the FortiGate's serial number (e.g., bcpbFG100E1234567890). The serial number is printed on the hardware label and also available before login via console.
5. Once logged in as maintainer, reset the admin password:

config system admin
    edit "admin"
        set password NewSecurePassword123!
    next
end

Step 6 — Factory Reset as Last Resort

If all other options fail, you can factory reset the FortiGate. This wipes all configuration and restores defaults (IP 192.168.1.99, admin with no password). Only do this if you have a backup of the configuration and understand the impact on your network.

Via CLI (if you have any CLI access):

execute factoryreset

Via the physical reset button: hold the reset button on the FortiGate unit for 10–15 seconds while the unit is powered on. The exact reset procedure varies by model — check the Fortinet hardware guide for your specific unit.

Step 7 — Port Conflicts

If another service on the FortiGate is using port 443 (for example, SSL-VPN), administrative HTTPS may be running on a different port, or HTTPS access may be disabled on that port entirely. Check:

show system global | grep -i admin

Key settings to look for:

If SSL-VPN is on port 443, move admin HTTPS to a different port (e.g., 8443) or move SSL-VPN to a different port:

config system global
    set admin-sport 8443
end

Step 8 — Browser-Specific Issues

FortiGate uses a self-signed certificate by default, which modern browsers flag as untrusted. This is not the same as the GUI being down — the page will usually still load if you proceed past the warning.

• Chrome: Click Advanced then Proceed to [IP] (unsafe)
• Firefox: Click Advanced then Accept the Risk and Continue
• Edge: Click Advanced then Continue to [IP] (unsafe)

If the certificate error page appears but you cannot proceed, try typing thisisunsafe directly on the Chrome error page (no field to type into — just type it on the page). This is a Chrome bypass for certificate errors in development/admin scenarios.

If the browser hangs or refuses to connect at all (not a certificate error but a connection timeout), the issue is at the network/firewall level, not the browser — go back to Steps 1–3.

Need Help?

Melbits provides managed IT support for Melbourne businesses, including emergency FortiGate recovery and remote console assistance. If you're locked out of your firewall and can't get back in, call us immediately on 1800 635 248 or contact us online — we can assist remotely or send a technician on-site.