Fortinet FortiGate Firewall STIG

18 items · Security · Hard difficulty · 2 hours

Harden your FortiGate firewall to DISA STIG standards.

• Backup current configuration

  Save running config to a secure location before changes.

• Export running configuration to external storage

  Use SCP, TFTP to secure server, or FortiManager export.

• Verify backup integrity and timestamp

  Confirm file integrity and record date/time of export.

• Verify device firmware is supported and up to date

  Check Fortinet advisories and apply vendor security patches.

• Review STIG documentation version and applicability

  Confirm Y26M01 applies to your model and enabled features.

• Set and enforce an administrative password policy

  Require complex passwords, rotation, and account lockouts.

• Configure role-based administrative accounts

  Create least-privilege admin roles and unique user accounts.

• Enable two-factor authentication for admin access

  Use FortiToken or other supported MFA for GUI/SSH logins.

• Restrict management access to trusted networks only

  Limit management interfaces and allowed source IPs.

• Disable unused services and ports

  Turn off Telnet, HTTP, SNMP v1/v2 and other unneeded services.

• Configure secure management protocols

  Use HTTPS, SSH, and SNMPv3 for remote management only.

• Harden SSH and SSL/TLS settings

  Disable weak ciphers; enforce TLS 1.2+ and secure SSH algorithms.

• Implement logging and forward logs to a central system

  Send logs to SIEM, FortiAnalyzer, and retain per policy.

• Enable audit logging for administrative actions

  Record config changes, admin logins, and privilege escalations.

• Review and implement least-privilege firewall rules

  Remove unused rules and restrict source/destination/service fields.

• Enable intrusion prevention and web filtering profiles

  Activate IPS/AV and URL filtering where traffic requires protection.

• Configure SSL/TLS inspection where required

  Manage inspection policies and trusted certificates carefully.

• Perform vulnerability scan and remediate findings

  Scan device and connected networks; prioritize and remediate risks.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.