STIGQter: STIG Summary: Fortinet FortiGate Firewall Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026:

In the event that communication with the central audit server is lost, the FortiGate firewall must continue to queue traffic log records locally.

DISA Rule

SV-234140r1038960_rule

Vulnerability Number

V-234140

Group Title

SRG-NET-000089-FW-000019

Rule Version

FNFG-FW-000045

Severity

CAT II

CCI(s)

CCI-000140 - Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records.

Weight

Fix Recommendation

For audit log resilience, it is required to log to the local FortiGate disk and a central audit server, or two central audit servers. To do this, log in to the FortiGate GUI with Super-Admin privilege.

1. Click Log and Report.
2. Click Log Settings.
3. For Local Log setting options, toggle the Disk setting to right.

To add a syslog server:
5. For Remote Logging and Archiving, toggle the Send logs to syslog setting and enter the appropriate IP address.
6. Click Apply to save the settings.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# config log disk setting
# set status enable
# set diskfull overwrite
# end
# config log syslogd setting
# set status enable
# set server {IP Address}
# set mode reliable
# end

Check Contents

Verify at least two logging options are configured. It can be any combination of local and/or remote logging.

Via the GUI:

Login via the FortiGate GUI with super-admin privileges.

- Navigate to Log and Report.
- Navigate to Log Settings.
- Verify the FortiGate Local Log disk settings.
- Verify the Remote and Archiving settings.

or

Via the CLI:

Open a CLI console via SSH or from the "CLI Console" button in the GUI.

Run the following commands to verify which logging settings are enabled:

# show full-configuration log disk setting | grep -i 'status\|diskfull'
- The output should indicate enabled.

# show full-configuration log fortianalyzer setting | grep -i 'status\|server'
# show full-configuration log fortianalyzer2 setting | grep -i 'status\|server'
# show full-configuration log fortianalyzer3 setting | grep -i 'status\|server'
# show full-configuration log syslogd setting | grep -i 'status\|server'
# show full-configuration log syslogd2 setting | grep -i 'status\|server'
# show full-configuration log syslogd3 setting | grep -i 'status\|server'
# show full-configuration log syslogd4 setting | grep -i 'status\|server'
- The output should indicate enabled and an IP address.

If the FortiGate is not logging to at least two locations (local and remote OR remote(x2) only), this is a finding.

In the event that communication with the central audit server is lost, the FortiGate firewall must continue to queue traffic log records locally.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key