STIGQter: STIG Summary: Fortinet FortiGate Firewall NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 05 Jan 2026:

The FortiGate devices must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of nonlocal maintenance and diagnostic communications.

DISA Rule

SV-234211r961554_rule

Vulnerability Number

V-234211

Group Title

SRG-APP-000411-NDM-000330

Rule Version

FGFW-ND-000260

Severity

CAT I

CCI(s)

• CCI-002890 - Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Network, Interfaces
2. Click the interface designated for device management traffic and pick Edit.
3. On Administrative Access, select HTTPS and SSH. Deselect HTTP.
4. Click OK.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# config system interface
# edit port{Management Port Integer #}
# set allowaccess ping https ssh
# end

Note: When adding or removing a protocol, the entire list of protocols must be typed again. For example, in an existing access list of HTTPS and SSH, if HTTP needs to be added, use the following CLI command:
# set allowaccess https ssh ping http

Check Contents

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Network, Interfaces.
2. Click the interface designated for device management traffic.
3. On Administrative Access, verify HTTPS and SSH are selected, and HTTP is not.

If HTTPS and SSH are not selected for administrative access, or HTTP is selected, this is a finding.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show full-configuration system interface port{Management Port Integer #} | grep -i allowaccess

The output should include:
set allowaccess ping https ssh

If the allowaccess parameter does not include https and ssh, this is a finding. If the allowaccess parameter includes http, this is a finding.

Vulnerability Number

V-234211

Documentable

False

Rule Version

FGFW-ND-000260

Severity Override Guidance

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Network, Interfaces.
2. Click the interface designated for device management traffic.
3. On Administrative Access, verify HTTPS and SSH are selected, and HTTP is not.

If HTTPS and SSH are not selected for administrative access, or HTTP is selected, this is a finding.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show full-configuration system interface port{Management Port Integer #} | grep -i allowaccess

The output should include:
set allowaccess ping https ssh

If the allowaccess parameter does not include https and ssh, this is a finding. If the allowaccess parameter includes http, this is a finding.

Check Content Reference

M

Target Key

5260