STIGQter: STIG Summary: Fortinet FortiGate Firewall NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 05 Jan 2026:

The FortiGate device must terminate idle sessions after 10 minutes of inactivity.

DISA Rule

SV-234213r984105_rule

Vulnerability Number

V-234213

Group Title

SRG-APP-000186-NDM-000266

Rule Version

FGFW-ND-000270

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

To configure the device to terminate all network connections when non-local maintenance is complete:

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click System.
2. Click Settings.
3. Go to Administrative Settings.
4. Enter the Idle Timeout value of 10.
5. Click Apply.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# config system global
# set admintimeout 10
# end

Check Contents

Verify the FortiGate device terminates all network connections when non-local device maintenance is complete.

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click System.
2. Click Settings.
3. Go to Administrative Settings.
4. Verify Idle Timeout is configured to 10 minutes.

If the idle-timeout value is not 10 minutes, this is a finding.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show full-configuration sys global | grep -i admintimeout

The output should be:
set admintimeout 10

If the admintimeout parameter is not set to 10 minutes, this is a finding.

Vulnerability Number

V-234213

Documentable

False

Rule Version

FGFW-ND-000270

Severity Override Guidance

Verify the FortiGate device terminates all network connections when non-local device maintenance is complete.

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click System.
2. Click Settings.
3. Go to Administrative Settings.
4. Verify Idle Timeout is configured to 10 minutes.

If the idle-timeout value is not 10 minutes, this is a finding.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command:
# show full-configuration sys global | grep -i admintimeout

The output should be:
set admintimeout 10

If the admintimeout parameter is not set to 10 minutes, this is a finding.

Check Content Reference

M

Target Key

5260