STIGQter STIGQter: STIG Summary: Fortinet FortiGate Firewall NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 05 Jan 2026:

The FortiGate device must prohibit the use of all unnecessary and/or non-secure functions, ports, protocols, and/or services.

DISA Rule

SV-234199r1043177_rule

Vulnerability Number

V-234199

Group Title

SRG-APP-000142-NDM-000245

Rule Version

FGFW-ND-000200

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Log in to the FortiGate GUI with Super-Admin privilege.
1. Click Policy and Objects.
2. Click IPv4 or IPv6 Policy.
3. Click +Create New.
4. Name the policy, and then select Incoming and Outgoing Interfaces.
5. Create policies with authorized sources and destinations.
6. Set action to DENY.
7. Ensure Enable this policy is toggled to right.
8. Click OK.
9. Ensure a policy is created for each interface and that every PPSM CAL and VA mitigation is covered.

Traffic is denied by default and policies must be configured to allow traffic that meets PPSM CAL and VA guidelines.

or

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following
# config system interface
# edit {INTERFACE-NAME}
# set {DHCP-RELAY-SERVICE | PPTP-CLIENT | ARPFORWARD | BROADCAST-FORWARD | L2FORWARD | ICMP-REDIRECT | VLANFORWARD | STPFORWARD | LLDP-TRANSMISSION} disable
# end
Create a new line for each service in {} that needs to be removed.

Check Contents

Log in to FortiGate GUI with Super-Admin privileges.

1. Click Policy and Objects.
2. Click Services, and then review services, functions, and ports that are allowed by the firewall.
3. Next, open a CLI console, via SSH or available from the GUI.
4. Run the following commands:
# show firewall policy
# show firewall policy6

Review policies to ensure that no restricted services, ports, protocols or functions are allowed. FortiGate is configured to deny by default, so if a service, port, protocol, or function is not specifically allowed, it will be denied.

If restricted functions, ports, protocols, and/or services are allowed by the firewall, this is a finding.

or

Log in to the FortiGate GUI with Super-Admin privilege.
1. Open a CLI console over SSH or available from the GUI.
2. Run the following
# show full-configuration system interface
3. Review configuration for unnecessary services.

If unnecessary services are configured, this is a finding.

Review the PPSM CAL and determine which functions, ports, protocols, and/or services must be disabled or restricted.

Vulnerability Number

V-234199

Documentable

False

Rule Version

FGFW-ND-000200

Severity Override Guidance

Log in to FortiGate GUI with Super-Admin privileges.

1. Click Policy and Objects.
2. Click Services, and then review services, functions, and ports that are allowed by the firewall.
3. Next, open a CLI console, via SSH or available from the GUI.
4. Run the following commands:
# show firewall policy
# show firewall policy6

Review policies to ensure that no restricted services, ports, protocols or functions are allowed. FortiGate is configured to deny by default, so if a service, port, protocol, or function is not specifically allowed, it will be denied.

If restricted functions, ports, protocols, and/or services are allowed by the firewall, this is a finding.

or

Log in to the FortiGate GUI with Super-Admin privilege.
1. Open a CLI console over SSH or available from the GUI.
2. Run the following
# show full-configuration system interface
3. Review configuration for unnecessary services.

If unnecessary services are configured, this is a finding.

Review the PPSM CAL and determine which functions, ports, protocols, and/or services must be disabled or restricted.

Check Content Reference

M

Target Key

5260