STIGQter: STIG Summary: Fortinet FortiGate Firewall Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026:

The FortiGate firewall must generate an alert that can be forwarded to, at a minimum, the Information System Security Officer (ISSO) and Information System Security Manager (ISSM) when denial-of-service (DoS) incidents are detected.

DISA Rule

SV-234158r971533_rule

Vulnerability Number

V-234158

Group Title

SRG-NET-000392-FW-000042

Rule Version

FNFG-FW-000150

Severity

CAT III

CCI(s)

• CCI-002664 - Alert organization-defined personnel or roles when organization-defined compromise indicators generate the occurrence of a compromise or a potential compromise.

Weight

10

Fix Recommendation

Syslog server is used to send alerts for DoS incidents. To enable syslog, log in to the FortiGate GUI with Super-Admin privileges.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# config log syslogd setting
# set status enable
# set server {IP address of site syslog server}
# set mode {reliable}
# set enc-algorithm {high-medium | high}
# set port {server listen port}
# set facility syslog
# set source-ip {source IP address}
# set max-log-rate {value between 1 and 100000}
# set certificate {certificate string}
# end

Check Contents

The firewall must be configured to send events to a syslog server. Anomaly events, such as a DoS attack are sent with a severity of critical. The syslog server will notify the ISSO and ISSM. To verify the syslog configuration, log in to the FortiGate GUI with Super-Admin privileges.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show full-configuration log syslogd setting | grep -i 'mode\|server'
The output should be:
set server {123.123.123.123}
set mode reliable

To ensure a secure connection, a certificate must be loaded, encryption enabled, and the SSL version set. To verify, while still in the CLI, run the following command:
# get log syslogd setting
Check for the following:
set enc-algorithm {MEDIUM-HIGH | HIGH}
set certificate

If the syslogd is not configured to send logs to a central syslog server, this is a finding.

Vulnerability Number

V-234158

Documentable

False

Rule Version

FNFG-FW-000150

Severity Override Guidance

The firewall must be configured to send events to a syslog server. Anomaly events, such as a DoS attack are sent with a severity of critical. The syslog server will notify the ISSO and ISSM. To verify the syslog configuration, log in to the FortiGate GUI with Super-Admin privileges.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show full-configuration log syslogd setting | grep -i 'mode\|server'
The output should be:
set server {123.123.123.123}
set mode reliable

To ensure a secure connection, a certificate must be loaded, encryption enabled, and the SSL version set. To verify, while still in the CLI, run the following command:
# get log syslogd setting
Check for the following:
set enc-algorithm {MEDIUM-HIGH | HIGH}
set certificate

If the syslogd is not configured to send logs to a central syslog server, this is a finding.

Check Content Reference

M

Target Key

5258