STIGQter: STIG Summary: Fortinet FortiGate Firewall Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026:

When employed as a premise firewall, FortiGate must block all outbound management traffic.

DISA Rule

SV-234154r852965_rule

Vulnerability Number

V-234154

Group Title

SRG-NET-000364-FW-000035

Rule Version

FNFG-FW-000125

Severity

CAT II

CCI(s)

• CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

10

Fix Recommendation

Log in to the FortiGate GUI with Super- or Firewall Policy-Admin privilege.

1. Click Policy and Objects.
2. Click IPv4 or IPv6 Policy.
3. Click +Create New.
4. Name the policy.
5. For the Incoming Interface, select the interface related to the Management Network.
6. For the Outgoing Interface, select an EGRESS interface.
7. For the Source, select the Management Network IP range.
8. For the Destination and Service, select ALL.
9. Configure the Policy Action to DENY.
10. Ensure the Enable this policy is toggled to right.
11. Click OK.

Repeat these steps for each EGRESS interface.

Check Contents

If FortiGate is not employed as a premise firewall, this requirement is Not Applicable.

Log in to the FortiGate GUI with Super- or Firewall Policy-Admin privilege.

1. Click Policy and Objects.
2. Click IPv4 or IPv6 Policy.
3. Verify there are Policies in which the Incoming Interface is the Management Network, and the Outgoing Interface is an EGRESS interface.
4. Verify these polices are configured with Action set to DENY.

If there are not DENY Policies where the Incoming Interface is the Management Network, and the Outgoing Interface is an EGRESS interface, this is a finding.

Vulnerability Number

V-234154

Documentable

False

Rule Version

FNFG-FW-000125

Severity Override Guidance

If FortiGate is not employed as a premise firewall, this requirement is Not Applicable.

Log in to the FortiGate GUI with Super- or Firewall Policy-Admin privilege.

1. Click Policy and Objects.
2. Click IPv4 or IPv6 Policy.
3. Verify there are Policies in which the Incoming Interface is the Management Network, and the Outgoing Interface is an EGRESS interface.
4. Verify these polices are configured with Action set to DENY.

If there are not DENY Policies where the Incoming Interface is the Management Network, and the Outgoing Interface is an EGRESS interface, this is a finding.

Check Content Reference

M

Target Key

5258