Skip to main content
New Member
June 8, 2026
Question

FIPS-CC and enabling ports | 71F

  • June 8, 2026
  • 2 replies
  • 41 views

Question: FIPS-CC is enabled. The interface is up. Why can’t I set allowaccess to permit https on port 1 for GUI access? 

The Background: 

I don’t have any FortiOS experience. I’ve been given a 71F to configure. The documentation describes enabling FIPS-CC, setting a new administrator password, and enabling the ports via 

config system interface

edit internal1

set status up

end

 

followed by changing the allowaccess attributes to add https via set or append

set allowaccess ping https

 

Neither append nor set allow me to do so, and set ? doesn’t list allowaccess as an option. the internal1 (port1) was part of a virtual switch. i’ve since removed it: 

config system virtual-switch

edit “internal”

config port

delete internal1

end

 

a ‘show’ command after each ‘end’ reflects that the configurations were accepted - internal1 is up and removed from the virtual-switch. if i `show full-configuration system interface | grep -f internal1’, i get the following attributes. 

config system interface
    edit "internal1" <---
        set vdom "root"
        set dhcp-classless-route-addition disable
        set status up
        set type physical
        set trunk disable
        set description ''
        set alias ''
        set ike-saml-server ''
        set role undefined
        set snmp-index 4
        set eap-supplicant disable
        set speed auto
    next
end
 

 

What am I missing to permit allowaccess? 

    2 replies

    Toshi_Esumi
    SuperUser
    SuperUser
    June 8, 2026

    What version are you running on the 71F? I tested it with 60F 7.4.12. But I was able to set “allowaccess” after enabling FIPS-CC then detaching “internal5” from internal VLAN switch.

    Toshi

    Derek T4Author
    New Member
    June 8, 2026

    I’m running 7.2 certified. I removed it from the internal VLAN switch and still wasn’t able to set allowaccess. I’m not sure what happened but:  

    • remove from internal switch
    • can pull full-configuration against config system interface → edit internal1 
    • enable wan1 (set status up) 

    and then I connected to the GUI via FortiCloud remote access. internal1 doesn’t show up in any of the interfaces. when I attempt to add it back to the switch via CLI, it gives a directory error. when i try to create internal1 in the GUI, it says it already exists. 

    i ended up blowing away the 71F, reinstalling the firmware, experienced the same issues, then just went through forticloud to enable https and separate everything. 

    Appreciate your post & outreach on this! 

    sjoshi
    Staff
    Staff
    June 9, 2026

    Were you able to enable https access from the GUI?

    Can you share:

    show sys interface

    show full sys interface internal1

    Thanks, Salon
    Derek T4Author
    New Member
    June 8, 2026

    removed this comment & replied in-line to Toshi above.