STIGQter: STIG Summary: Fortinet FortiGate Firewall NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 05 Jan 2026:

The FortiGate device must use LDAPS for the LDAP connection.

DISA Rule

SV-234208r961029_rule

Vulnerability Number

V-234208

Group Title

SRG-APP-000172-NDM-000259

Rule Version

FGFW-ND-000245

Severity

CAT I

CCI(s)

• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.

Weight

10

Fix Recommendation

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# config user ldap
# edit {ldap_server_name}
# set server {server_ip}
# set cnid {cn}
# set dn {dc=XYZ,dc=fortinet,dc=COM}
# set type regular
# set username {cn=Administrator,dc=XYA, dc=COM}
# set password {bind password}
# set secure ldaps
# set ca-cert {CA certificate name}
# next
# end

Check Contents

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show full-configuration user ldap | grep -i ldaps
The output should be:
set secure ldaps

If set secure is not set to ldaps, this is a finding.

Vulnerability Number

V-234208

Documentable

False

Rule Version

FGFW-ND-000245

Severity Override Guidance

Log in to the FortiGate GUI with Super-Admin privilege.

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show full-configuration user ldap | grep -i ldaps
The output should be:
set secure ldaps

If set secure is not set to ldaps, this is a finding.

Check Content Reference

M

Target Key

5260