STIGQter: STIG Summary: Fortinet FortiGate Firewall NDM Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 05 Jan 2026:

The FortiGate device must limit the number of logon and user sessions.

DISA Rule

SV-234219r960735_rule

Vulnerability Number

V-234219

Group Title

SRG-APP-000001-NDM-000200

Rule Version

FGFW-ND-000300

Severity

CAT II

CCI(s)

• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Weight

10

Fix Recommendation

Log in to the FortiGate GUI with Super-Admin privilege and open a CLI console available from the GUI.
or
Connect via SSH.

Execute the following commands:
config system global
set admin-concurrent disable
set admin-login-max <number defined by the organization>
end

With the implementation of this requirement, the organization can limit each administrator to one active session and limit the total number of concurrent administrator sessions to a value deemed appropriate.

Check Contents

Log in to the FortiGate GUI with Super-Admin privilege and open a CLI console available from the GUI.
or
Connect via SSH.

Run the following command:
show full-configuration sys global | grep -i admin

Check the output of the following lines:
set admin-concurrent disable
set admin-login-max <number as defined by the organization>

If set admin-concurrent is not set to disable, this is a finding.
If set admin-login-max is not set to a number defined by the organization, this is a finding. The default setting is 100.

Vulnerability Number

V-234219

Documentable

False

Rule Version

FGFW-ND-000300

Severity Override Guidance

Log in to the FortiGate GUI with Super-Admin privilege and open a CLI console available from the GUI.
or
Connect via SSH.

Run the following command:
show full-configuration sys global | grep -i admin

Check the output of the following lines:
set admin-concurrent disable
set admin-login-max <number as defined by the organization>

If set admin-concurrent is not set to disable, this is a finding.
If set admin-login-max is not set to a number defined by the organization, this is a finding. The default setting is 100.

Check Content Reference

M

Target Key

5260