STIGQter: STIG Summary: Fortinet FortiGate Firewall NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 05 Jan 2026:

The FortiGate device must use LDAP for authentication.

DISA Rule

SV-234192r1137887_rule

Vulnerability Number

V-234192

Group Title

SRG-APP-000516-NDM-000336

Rule Version

FGFW-ND-000165

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.
• CCI-000370 - Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.

Weight

10

Fix Recommendation

Log in to the FortiGate GUI with Super-Admin privilege.

Configure the LDAP server connection.

1. Go to User and Device.
2. Go to LDAP Servers and select +Create New.
3. Enter the server Name, Server IP address, or Name.
4. Enter the Common Name Identifier and Distinguished Name.
5. Set the Bind Type to Regular and enter the LDAP bind Username and Password.
6. Ensure the Secure Connection button is toggled to enable.
7. In Protocol, select LDAPS. Select certificate.
8. Click OK.

Add the LDAP server to a user group.

1. Go to User and Device.
2. Under User Groups, select +Create New.
3. Enter a Name for the group.
4. In the Remote groups section, select +Add.
5. Select the Remote Server from the dropdown list.
6. Click OK.

Then, configure the administrator account.

1. Click System.
2. Click Administrators.
3. Click +Create New and choose Administrator.
4. Specify the Username.
5. Set Type to Match a user on a remote server group.
6. In Remote User Group, select the user group that was created.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Configure the LDAP server in the CLI:
# config user ldap
# edit {ldap_server_name}
# set server {server_ip}
# set cnid {cn}
# set dn {dc=XYZ,dc=fortinet,dc=COM}
# set type regular
# set username {cn=Administrator,dc=XYA, dc=COM}
# set password {bind password}
# set secure ldaps
# set ca-cert {CA certificate name}
# next
# end

3. Create a user group in the CLI:
# config user group
# edit {Group_name}
# set member {ldap_server_name}
# next
# end

4. Create an administrator in the CLI:
# config system admin
# edit {admin_name}
# set remote-auth enable
# set accprofile {profile name}
# set remote-group ldap
# end

Check Contents

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click System.
2. Click Administrators.
3. Verify all users except admin are assigned to a remote LDAP user group.

If all administrators except admin are not configured to use remote LDAP authentication, this is a finding.

Vulnerability Number

V-234192

Documentable

False

Rule Version

FGFW-ND-000165

Severity Override Guidance

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click System.
2. Click Administrators.
3. Verify all users except admin are assigned to a remote LDAP user group.

If all administrators except admin are not configured to use remote LDAP authentication, this is a finding.

Check Content Reference

M

Target Key

5260