STIGQter: STIG Summary: Fortinet FortiGate Firewall NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 05 Jan 2026:

The FortiGate device must implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.

DISA Rule

SV-234212r961557_rule

Vulnerability Number

V-234212

Group Title

SRG-APP-000412-NDM-000331

Rule Version

FGFW-ND-000265

Severity

CAT I

CCI(s)

• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Network, Interfaces.
2. Click the interface designated for device management traffic and pick Edit.
3. On Administrative Access, select HTTPS and SSH. Deselect HTTP.
4. Click OK.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command for all low privileged admin users:
# config system interface
# edit port{Management Port Integer #}
# set allowaccess ping https ssh
# end

Note: When a protocol is added or removed, the entire list of protocols must be typed in again. For example, to add PING to an access list of HTTPS and SSH, use the following CLI command:
# set allowaccess https ssh ping

Check Contents

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Network, Interfaces.
2. Click the interface designated for device management traffic.
3. On Administrative Access, verify HTTPS and SSH are selected.

If HTTPS and SSH are not selected for administrative access, this is a finding.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command for all low privileged admin user:
# show full-configuration system interface port{Management Port Integer #} | grep -i allowaccess

The output should include:
set allowaccess ping https ssh

If https and ssh are not returned, this is a finding. If http is returned, this is a finding.

Vulnerability Number

V-234212

Documentable

False

Rule Version

FGFW-ND-000265

Severity Override Guidance

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Network, Interfaces.
2. Click the interface designated for device management traffic.
3. On Administrative Access, verify HTTPS and SSH are selected.

If HTTPS and SSH are not selected for administrative access, this is a finding.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command for all low privileged admin user:
# show full-configuration system interface port{Management Port Integer #} | grep -i allowaccess

The output should include:
set allowaccess ping https ssh

If https and ssh are not returned, this is a finding. If http is returned, this is a finding.

Check Content Reference

M

Target Key

5260