STIGQter: STIG Summary: Fortinet FortiGate Firewall NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 05 Jan 2026:

The FortiGate device must authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).

DISA Rule

SV-234201r961506_rule

Vulnerability Number

V-234201

Group Title

SRG-APP-000395-NDM-000310

Rule Version

FGFW-ND-000210

Severity

CAT II

CCI(s)

• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

10

Fix Recommendation

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click System.
2. Click SNMP.
3. Select each SNMPv3 user.
4. Click Edit.
5. On Security Level, click Authentication.
6. Select SHA256 for the Authentication Algorithm.
7. Change the Password if required.
8. Click OK.
9. Click Apply.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# config system snmp user
# edit {NAME}
# set status enable
# set security-level auth
# set auth-proto sha256
# set auth-pwd {PASSWORD}
# next
# end

Check Contents

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click System.
2. Click SNMP.
3. Verify the SNMPv3 settings are configured and enabled.
4. Select each SNMPv3 user and click Edit.
5. On Security Level, verify the SNMPv3 user is configured to use SHA256 as the Authentication Algorithm.

If the FortiGate device is not configured to authenticate SNMP messages using a FIPS-validated HMAC, this is a finding.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:

# show full-configuration system snmp user | grep -i 'security-level\ |auth-proto'

For each SNMPv3 user, the output should be similar to:

set security-level auth
set auth-proto sha256

If the security-level parameter is not set to auth or auth-priv, and the auth-proto is not set to SHA, this is a finding.

Vulnerability Number

V-234201

Documentable

False

Rule Version

FGFW-ND-000210

Severity Override Guidance

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click System.
2. Click SNMP.
3. Verify the SNMPv3 settings are configured and enabled.
4. Select each SNMPv3 user and click Edit.
5. On Security Level, verify the SNMPv3 user is configured to use SHA256 as the Authentication Algorithm.

If the FortiGate device is not configured to authenticate SNMP messages using a FIPS-validated HMAC, this is a finding.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:

# show full-configuration system snmp user | grep -i 'security-level\ |auth-proto'

For each SNMPv3 user, the output should be similar to:

set security-level auth
set auth-proto sha256

If the security-level parameter is not set to auth or auth-priv, and the auth-proto is not set to SHA, this is a finding.

Check Content Reference

M

Target Key

5260