STIGQter: STIG Summary: Fortinet FortiGate Firewall Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026:

The FortiGate firewall must send traffic log entries to a central audit server for management and configuration of the traffic log entries.

DISA Rule

SV-234149r953982_rule

Vulnerability Number

V-234149

Group Title

SRG-NET-000333-FW-000014

Rule Version

FNFG-FW-000100

Severity

CAT II

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Log and Report.
2. Click Log Settings.
3. Go to Remote Logging and Archiving.

If using FortiAnalyzer:
4. Toggle Send logs to FortiAnalyzer/FortiManager to the right.
5. Configure FortiAnalyzer/FortiManager with designated IP address.
6. Configure Upload Option, SSL encrypt log transmission and Allow access to FortiGate REST API per the organizational requirement.

If using a central syslog server:
7. Toggle Send logs to syslog to the right.
8. Configure syslog settings with designated IP Address/FQDN.
9. Click Apply.

or

Log in to the FortiGate GUI with Super-Admin privilege.

Open a CLI console, via SSH or available from the GUI.

If using FortiAnalyzer, run the following command:
# config log fortianalyzer setting
# set status enable
# set server {IP address}
# end

If using central syslog Server, run the following command:
# config log syslogd setting
# set status enable
# set server {IP address}
# end

Check Contents

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Log and Report.
2. Click Log Settings.
3. Under Remote Logging and Archiving, verify FortiAnalyzer and/or syslog settings are enabled and configured with IP addresses of central FortiAnalyzer or Syslog server(s).

or

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show full-configuration log syslogd setting | grep -i status
Check output for:
set status enable
3. Run the following command:
# show full-configuration log fortianalyzer setting | grep -i status
check output for:
set status enable

If the FortiGate is not configured to send traffic logs to a central audit server, this is a finding.

Vulnerability Number

V-234149

Documentable

False

Rule Version

FNFG-FW-000100

Severity Override Guidance

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Log and Report.
2. Click Log Settings.
3. Under Remote Logging and Archiving, verify FortiAnalyzer and/or syslog settings are enabled and configured with IP addresses of central FortiAnalyzer or Syslog server(s).

or

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show full-configuration log syslogd setting | grep -i status
Check output for:
set status enable
3. Run the following command:
# show full-configuration log fortianalyzer setting | grep -i status
check output for:
set status enable

If the FortiGate is not configured to send traffic logs to a central audit server, this is a finding.

Check Content Reference

M

Target Key

5258