Fortinet FortiOS stock definitions

Stock definitions for Fortinet FortiGate, from the fortinet/ folder. They check the FortiOS configuration as returned by show full-configuration: config, edit, set, next and end blocks with indented set lines. This page documents release v1.2.0. See importing a stock template to load one into rConfig.

Hardening definitions

FortiOS management access

fortios-management-access.policy · 4 rules · minimum rConfig 8.3.0 · Synthetic tested

A 10-minute admin idle timeout, no insecure protocols in interface allowaccess, strong crypto and the pre-login banner.

Rule	Method	What it checks
The admin idle timeout is 10 minutes (set admintimeout 10)	evaluate_block	The config system global section contains exactly set admintimeout 10. Other values, including 100, fail.
No interface allowaccess line permits telnet, http, rsh or rexec	must_not_match_regex	No set allowaccess line includes telnet, http, rsh or rexec. https is allowed.
Strong crypto is enabled (set strong-crypto enable)	evaluate_block	The config system global section contains set strong-crypto enable. set strong-crypto disable, or the line in another section, fails.
The pre-login banner is enabled (set pre-login-banner enable)	evaluate_block	The config system global section contains set pre-login-banner enable. set post-login-banner enable on its own does not count.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)	NIST CSF 1.1
The admin idle timeout is 10 minutes (set admintimeout 10)	AC-2	164.312(a)(1)	None
No interface allowaccess line permits telnet, http, rsh or rexec	CM-7	164.312(c)(1)	None
Strong crypto is enabled (set strong-crypto enable)	AC-17	164.312(a)(1)	PR.AC-1

Known limitations

• equals: compares the whole trimmed line, so set admintimeout 10 does not match set admintimeout 100.
• The rules use only settings documented under config system global in the FortiOS 7.4.4 CLI Reference. Release v1.2.0 removed the rules that checked set admin-https, set admin-http, set motd and set admin-addrgrp, which are not documented there.

FortiOS AAA and password policy

fortios-aaa.policy · 2 rules · minimum rConfig 8.3.0 · Synthetic tested

A RADIUS server with an address, and an enabled password policy with a minimum length of 12.

Rule	Method	What it checks
A RADIUS server entry sets a server address (config user radius)	evaluate_block	The config user radius section has at least one set server line with a non-empty address.
The password policy is enabled with a minimum length of 12 (set min-length 12 or set minimum-length 12)	evaluate_block	The config system password-policy section contains set status enable and either set min-length 12 or set minimum-length 12.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53
The password policy is enabled with a minimum length of 12 (set min-length 12 or set minimum-length 12)	IA-5

Known limitations

• A scoped rule fails when no config section matches its scope, so a config with no config user radius section fails the RADIUS rule.
• The password rule accepts set min-length 12 (older FortiOS) or set minimum-length 12 (FortiOS 7).

FortiOS SNMP

fortios-snmp.policy · 2 rules · minimum rConfig 8.3.0 · Synthetic tested

No SNMPv1 or SNMPv2c communities, and SHA authentication with AES privacy for every SNMPv3 user.

Rule	Method	What it checks
No SNMPv1 or SNMPv2c community is configured (config system snmp community is absent)	must_not_match_regex	The config has no config system snmp community section.
Every SNMPv3 user uses SHA authentication and AES privacy	evaluate_block	In the config system snmp user section, every set auth-proto line uses a SHA variant and every set priv-proto line uses an AES variant, and at least one of each is present.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)
No SNMPv1 or SNMPv2c community is configured (config system snmp community is absent)	SC-12	164.312(e)(1)
Every SNMPv3 user uses SHA authentication and AES privacy	SC-12	164.312(e)(1)

Known limitations

• The SNMPv3 rule checks the whole config system snmp user section, so one user with a non-SHA auth-proto or a non-AES priv-proto fails it.

FortiOS logging

fortios-logging.policy · 2 rules · minimum rConfig 8.3.0 · Synthetic tested

Remote syslog enabled with a server on UDP port 514, and a syslog filter severity of information or notice.

Rule	Method	What it checks
Remote syslog is enabled with a server on UDP port 514 (config log syslogd setting)	evaluate_block	The config log syslogd setting section contains set status enable, a non-empty set server, set port 514 and set mode udp.
The syslog filter severity is information or notice (config log syslogd filter)	evaluate_block	The config log syslogd filter section contains set severity information or set severity notice.

References

Published references recorded in the sidecar. A rule provides evidence towards a control; it does not make a device compliant with it.

Rule	NIST SP 800-53	HIPAA (45 CFR)	NIST CSF 1.1
Remote syslog is enabled with a server on UDP port 514 (config log syslogd setting)	AU-2, AU-12	164.312(b)	DE.CM-1
The syslog filter severity is information or notice (config log syslogd filter)	AU-2, AU-12	164.312(b)	None

Known limitations

• The severity rule accepts information or notice, because both values were used by the earlier framework files and both cannot pass on one config.

Operational standards

Caution

Operational standards files are templates to edit with your own values, not hardening checks. The server and hostname rules use example values (RFC 5737 addresses such as 192.0.2.10, and an example hostname pattern), so expect them to fail until you replace those values with your own standard.

FortiOS operational standards

fortios-operational-standards.policy · 7 rules · minimum rConfig 8.3.0 · Synthetic tested

Checks drift from your own operational standard, not a hardening baseline: standard NTP, syslog (syslogd and syslogd2) and DNS servers, a pre-login banner, a description on every interface that is not set to status down, a hostname naming pattern and an SNMP location. Replace the example values (RFC 5737 addresses such as 192.0.2.10, and the hostname pattern) with your own before use.

Rule	Method	What it checks
NTP servers are set to your standard (replace 192.0.2.10 and 192.0.2.11)	evaluate_block	The config system ntp section contains set ntpsync enable, set type custom, set server "192.0.2.10" and set server "192.0.2.11".
Syslog servers are set to your standard (replace 192.0.2.20 in syslogd and 192.0.2.21 in syslogd2)	evaluate_block	The config log syslogd setting section contains set status enable and set server "192.0.2.20", and the config log syslogd2 setting section contains set status enable and set server "192.0.2.21".
DNS servers are set to your standard (replace 192.0.2.30 and 192.0.2.31)	evaluate_block	The config system dns section contains set primary 192.0.2.30 and set secondary 192.0.2.31.
A pre-login banner is enabled (set pre-login-banner enable; nothing to replace)	evaluate_block	The config system global section contains set pre-login-banner enable.
Every interface that is not set to status down has a description (nothing to replace)	evaluate_block	In config system interface, every edit entry has set status down or a non-empty set description.
The hostname follows your naming pattern (replace the example pattern [a-z]{3}-fw[0-9]{2}, for example dub-fw01)	evaluate_block	The config system global section has a set hostname line whose quoted value matches the pattern exactly.
An SNMP location is set (set location in config system snmp sysinfo, any text; nothing to replace)	evaluate_block	The config system snmp sysinfo section has a set location line with a non-empty value.

Known limitations

• The NTP, syslog and DNS rules check that each standard server is configured, not that no other server is.
• The syslog rule is a regular expression: escape the dots when you replace an address, for example 192\.0\.2\.20. The NTP and DNS rules compare whole lines, so type those addresses as they are.
• The interface rule expects FortiOS’s four-space indentation and counts set description, not set alias. An empty set description "" does not count.

Build templates

Caution

Build templates are starting templates to edit, not compliance checks. The rules use example values (hostnames, addresses, servers), so expect them to fail until you replace those values with your own standard.

FortiOS build template

fortios-build-template.policy · 10 rules · minimum rConfig 8.0.0 · Synthetic tested

Starting template for a new FortiGate build, not a compliance check: hostname, timezone, admin access, LAN interface, DHCP, DNS, NAT and firewall policies, NTP and logging. Replace the example values (for example set hostname MyFortinet and 192.168.88.0/24) with your own before use.

Every rule uses example values, so the rules fail against the samples until they are edited.

Rule	Method	What it checks
Description: must_match_all_from_array Set Hostname	must_match_all_from_array	The lines config system global, set hostname MyFortinet and end each appear somewhere in the config.
Description: must_match_all_from_array Set Timezone	must_match_all_from_array	The lines config system global, set timezone 32 and end each appear somewhere in the config.
Description: must_match_all_from_array Secure Access Settings	must_match_all_from_array	Each listed line appears somewhere in the config: config system global, set admin-scp enable, set admin-https-redirect disable, config system interface, edit "mgmt" and set allowaccess ping https ssh.
Description: must_match_all_from_array Configure LAN Interface	must_match_all_from_array	Each listed line appears somewhere in the config: config system interface, edit "lan", set ip 192.168.88.1/24 and set allowaccess ping https ssh.
Description: must_match_all_from_array DHCP Server Setup	must_match_all_from_array	Each line of DHCP server edit 1 appears somewhere in the config: gateway, netmask, interface lan and the .10 to .254 range.
Description: must_match_all_from_array DNS Setup	must_match_all_from_array	The lines config system dns, set primary 8.8.8.8, set secondary 8.8.4.4 and end each appear in the config.
Description: must_match_all_from_array Enable NAT	must_match_all_from_array	Each line of firewall policy edit 1 (LAN to wan1, accept, all services, set nat enable) appears somewhere in the config.
Description: must_match_all_from_array Basic Firewall Rules	must_match_all_from_array	Each line of firewall policies edit 2 (LAN to wan1, accept) and edit 3 (wan1 to LAN, deny) appears somewhere in the config.
Description: must_match_all_from_array Enable NTP Client	must_match_all_from_array	The config system ntp lines set server1, set server2, set syncinterval 60 and set status enable each appear in the config.
Description: must_match_all_from_array Set Up Logging	must_match_all_from_array	Each listed line appears in the config: disk, memory and syslog logging enabled, set fwpolicy-implicit-log enable and set server 192.168.88.2.

Each line of a must_match_all_from_array body is checked on its own, as text anywhere in the config. The method does not check order or which section a line sits in.