STIGQter: STIG Summary: Fortinet FortiGate Firewall NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 05 Jan 2026:

The FortiGate device must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.

DISA Rule

SV-234202r961506_rule

Vulnerability Number

V-234202

Group Title

SRG-APP-000395-NDM-000347

Rule Version

FGFW-ND-000215

Severity

CAT II

CCI(s)

• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

10

Fix Recommendation

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:

# config system ntp
# set ntpsync enable
# set type custom
# set syncinterval {INTEGER}
# config ntpserver
# edit {ID}
# set server {IP ADDRESS}
# set authentication enable
# set key {PASSWORD}
# set key-id {INTEGER}
# next
# end

Check Contents

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# diagnose sys ntp status

The output should be similar to:
ipv4 server(URL of NTP server) 123.123.123.123 -- reachable(0xbf) S:1 T:242 selected
server-version=4, stratum=2
reference time is e213a5fb.2250b45e -- UTC Wed Mar 11 18:01:31 2020
clock offset is 0.000801 sec, root delay is 0.000381 sec
root dispersion is 0.053268 sec, peer dispersion is 287 msec

If the output does not return server-version is equal to 4, this is a finding.

Vulnerability Number

V-234202

Documentable

False

Rule Version

FGFW-ND-000215

Severity Override Guidance

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# diagnose sys ntp status

The output should be similar to:
ipv4 server(URL of NTP server) 123.123.123.123 -- reachable(0xbf) S:1 T:242 selected
server-version=4, stratum=2
reference time is e213a5fb.2250b45e -- UTC Wed Mar 11 18:01:31 2020
clock offset is 0.000801 sec, root delay is 0.000381 sec
root dispersion is 0.053268 sec, peer dispersion is 287 msec

If the output does not return server-version is equal to 4, this is a finding.

Check Content Reference

M

Target Key

5260