System and Network Settings
Interfaces, administrators, and VDOMs
Administrative access is granted per interface: HTTPS, SSH, ping, SNMP, RADIUS accounting and FortiManager access are checkboxes on each interface. A classic exam trap is disabling HTTPS (or changing the management port) on the interface you are managing through, locking yourself out; the safe habit is to enable the new access method, verify it works, then disable the old one.
Administrators are separate from admin profiles. The profile defines read/write scope per area (firewall, routing, VPN, system), and only the built-in super_admin profile grants everything. Profiles are re-evaluated at login, so a profile change does not retroactively alter an open session. Trusted hosts and two-factor options further restrict where and how an admin may log in.
Interfaces can be addressed statically, by DHCP, or by PPPoE, and can be grouped into VLAN sub-interfaces, software switches or zones. A zone lets one policy reference several ports, but a zone cannot mix members from different VDOMs and removing a member changes what your policies match. DHCP client interfaces have their own distance value for the learned default gateway; a low-distance DHCP gateway can silently displace a static default route.
Enabling VDOM mode splits the device into independent virtual firewalls, each with its own interfaces, routing table, policies and admins; on most models this requires a reboot. Global settings such as HA and firmware remain device-wide.
Rule of thumb: change one thing at a time. Before touching admin access, VDOM mode or firmware, take a backup, confirm console access, and confirm NTP and DNS are correct - FortiGuard updates and certificate validation fail quietly when the clock is wrong.