STIGQter: STIG Summary: Fortinet FortiGate Firewall Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026:

The FortiGate firewall must fail to a secure state if the firewall filtering functions fail unexpectedly.

DISA Rule

SV-234148r611444_rule

Vulnerability Number

V-234148

Group Title

SRG-NET-000235-FW-000133

Rule Version

FNFG-FW-000090

Severity

CAT II

CCI(s)

• CCI-001190 - Fail to an organization-defined known-system state for the following failures on the indicated components while preserving organization-defined system state information in failure.

Weight

10

Fix Recommendation

FortiGate will inherently fail closed upon a power failure. Additionally, the FortiOS kernel enters conserve mode when memory use reaches the red threshold (default 88 percent memory use). When the red threshold is reached, FortiOS functions that react to conserve mode, such as the antivirus transparent proxy, apply conserve mode based on configured conserve mode settings. Additionally, FortiOS generates conserve mode log messages and SNMP traps, and a conserve mode banner appears on the GUI. If memory use reaches the extreme threshold (95 percent memory used), new sessions are dropped and red threshold conserve mode actions continue.

Conserve mode actions for filtering are configured as follows:

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# config ips global
# set fail-open disable
# end
# config system global
# set av-failopen off
# set av-failopen-session disable
# end

Check Contents

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show ips global | grep -i fail-open
# show system global | grep -i failopen

If ips fail-open is set to enable or av-failopen is not set to off or av-failopen-session is not set to disable, this is a finding.

Vulnerability Number

V-234148

Documentable

False

Rule Version

FNFG-FW-000090

Severity Override Guidance

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show ips global | grep -i fail-open
# show system global | grep -i failopen

If ips fail-open is set to enable or av-failopen is not set to off or av-failopen-session is not set to disable, this is a finding.

Check Content Reference

M

Target Key

5258