STIGQter: STIG Summary: Fortinet FortiGate Firewall Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026:

The FortiGate firewall must protect traffic log records from unauthorized access while in transit to the central audit server.

DISA Rule

SV-234141r835165_rule

Vulnerability Number

V-234141

Group Title

SRG-NET-000098-FW-000021

Rule Version

FNFG-FW-000050

Severity

CAT II

CCI(s)

• CCI-000162 - Protect audit information from unauthorized access.

Weight

10

Fix Recommendation

Log in to the FortiGate GUI with Super-Admin privilege.

First, upload the CA certificate that issued the Syslog server certificate.
1. Click System.
2. Click Certificates.
3. Click Import, then CA Certificate.
4. Specify File, and click + Upload.
5. Choose the CA Certificate to upload from the local hard drive.
6. Click OK.

Then, configure a TLS-enabled syslog connection:
1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# config log syslogd setting
# set status enable
# set server {SYSLOG SERVER IP ADDRESS}
# set mode reliable
# set enc-algorithm {HIGH-MEDIUM | HIGH}
# set certificate (Optional - Select local certificate if Syslog server is challenging client [FortiGate] for authentication)
# end

Note: The server IP address must be on the site's management network.

Check Contents

Log in to the FortiGate GUI with Super-Admin privileges.

1. Open a CLI console via SSH or from the GUI widget.
2. Run the following command:
# show full-configuration log syslogd setting
The output should include:
set server {123.123.123.123}
set mode reliable
set enc-algorithm {medium-high | high}

If the syslogd mode is not set to reliable, this is a finding.
If the set enc-algorithm is not set to high or medium-high, this is a finding.

Vulnerability Number

V-234141

Documentable

False

Rule Version

FNFG-FW-000050

Severity Override Guidance

Log in to the FortiGate GUI with Super-Admin privileges.

1. Open a CLI console via SSH or from the GUI widget.
2. Run the following command:
# show full-configuration log syslogd setting
The output should include:
set server {123.123.123.123}
set mode reliable
set enc-algorithm {medium-high | high}

If the syslogd mode is not set to reliable, this is a finding.
If the set enc-algorithm is not set to high or medium-high, this is a finding.

Check Content Reference

M

Target Key

5258