FortiGate NSE4: Rotating Admin Credentials Without Downtime

Rotating admin credentials on FortiGate firewalls is a security best practice, but many engineers worry about causing downtime or locking themselves out. The good news: FortiGate supports multiple concurrent admin accounts with different authentication methods, allowing you to rotate credentials safely without interrupting management access or active traffic. This guide covers the NSE4-level approach to credential rotation in production environments.

Why Rotate Admin Credentials

Regular credential rotation reduces the window of exposure if a password is compromised, meets compliance requirements (PCI-DSS, SOC 2, ISO 27001), and prevents credential creep when staff change roles or leave the organization. On FortiGate, rotation is straightforward because you can create new admin accounts before retiring old ones, ensuring continuous access throughout the process.

Step 1: Create a Secondary Admin Account

Before modifying or retiring your primary admin account, create a second admin user with identical or greater permissions. This ensures you retain access if something goes wrong with the first account.

config system admin
  edit "admin-secondary"
    set password <new-strong-password>
    set accprofile "super_admin"
    set vdom "root"
  next
end

Verify the new account works by logging out and testing login with admin-secondary credentials. Only proceed once you confirm access.

Step 2: Rotate the Primary Admin Password

Once the secondary account is confirmed working, update the primary admin password. You can do this via CLI or GUI without any service interruption.

config system admin
  edit "admin"
    set password <new-strong-password>
  next
end

Test the new primary password immediately. If successful, update your credential vault or password manager. If unsuccessful, you still have the secondary account for troubleshooting.

Step 3: Implement SSH Key Authentication (Optional)

For additional security, configure SSH public key authentication alongside password authentication. This is especially valuable for automated tools and scripts that need admin access.

config system admin
  edit "admin"
    set ssh-public-key1 "ssh-rsa AAAA..."
  next
end

You can maintain both password and SSH key methods simultaneously, giving you flexibility during rotation windows.

Step 4: Retire Old Credentials Safely

After confirming both primary and secondary accounts work, and all scripts or automation tools have been updated to use the new credentials, you can retire the secondary account.

config system admin
  delete "admin-secondary"
end

• →Verify all automated tools (monitoring, backup, API calls) use updated credentials before deletion
• →Document the rotation date and new password expiry policy in your change log
• →Review FortiGate audit logs to confirm no unexpected admin actions occurred during rotation
• →Update your disaster recovery and runbook documentation with current credentials

Best Practices for NSE4-Level Rotation

• →Rotate credentials every 90 days or per your organization's policy
• →Use strong passwords: 16+ characters, mixed case, numbers, and symbols
• →Never reuse passwords across multiple admin accounts or devices
• →Log all credential changes in your change management system
• →Consider using RADIUS or LDAP for centralized admin authentication at scale
• →Test credential rotation in a lab environment first if managing multiple FortiGates
• →Maintain an offline backup of emergency admin credentials in a secure vault

Credential rotation on FortiGate is a low-risk operation when done methodically. By creating a secondary account first, you eliminate the risk of lockout and can rotate with confidence in production environments.