The FortiGate device must implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-234212	FGFW-ND-000265	SV-234212r628777_rule		High

Description
This requires the use of secure protocols instead of their unsecured counterparts, such as SSH instead of telnet, SCP instead of FTP, and HTTPS instead of HTTP. If unsecured protocols (lacking cryptographic mechanisms) are used for sessions, the contents of those sessions will be susceptible to eavesdropping, potentially putting sensitive data (including administrator passwords) at risk of compromise and potentially allowing hijacking of maintenance sessions.

Description

This requires the use of secure protocols instead of their unsecured counterparts, such as SSH instead of telnet, SCP instead of FTP, and HTTPS instead of HTTP. If unsecured protocols (lacking cryptographic mechanisms) are used for sessions, the contents of those sessions will be susceptible to eavesdropping, potentially putting sensitive data (including administrator passwords) at risk of compromise and potentially allowing hijacking of maintenance sessions.

STIG	Date
Fortinet FortiGate Firewall NDM Security Technical Implementation Guide	2021-01-29

Details

Check Text ( C-37397r611823_chk )
Log in to the FortiGate GUI with Super-Admin privilege. 1. Click Network, Interfaces. 2. Click the interface designated for device management traffic. 3. On Administrative Access, verify HTTPS and SSH are selected. If HTTPS and SSH are not selected for administrative access, this is a finding. or 1. Open a CLI console, via SSH or available from the GUI. 2. Run the following command for all low privileged admin user: # show full-configuration system interface port{Management Port Integer #} \| grep -i allowaccess The output should include: set allowaccess ping https ssh If https and ssh are not returned, this is a finding. If http is returned, this is a finding.

Check Text ( C-37397r611823_chk )

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Network, Interfaces.
2. Click the interface designated for device management traffic.
3. On Administrative Access, verify HTTPS and SSH are selected.

If HTTPS and SSH are not selected for administrative access, this is a finding.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command for all low privileged admin user:
# show full-configuration system interface port{Management Port Integer #} | grep -i allowaccess

The output should include:
set allowaccess ping https ssh

If https and ssh are not returned, this is a finding. If http is returned, this is a finding.

Fix Text (F-37362r611824_fix)
Log in to the FortiGate GUI with Super-Admin privilege. 1. Click Network, Interfaces. 2. Click the interface designated for device management traffic and pick Edit. 3. On Administrative Access, select HTTPS and SSH. Deselect HTTP. 4. Click OK. or 1. Open a CLI console, via SSH or available from the GUI. 2. Run the following command for all low privileged admin users: # config system interface # edit port{Management Port Integer #} # set allowaccess ping https ssh # end Note: When a protocol is added or removed, the entire list of protocols must be typed in again. For example, to add PING to an access list of HTTPS and SSH, use the following CLI command: # set allowaccess https ssh ping

Fix Text (F-37362r611824_fix)

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Network, Interfaces.
2. Click the interface designated for device management traffic and pick Edit.
3. On Administrative Access, select HTTPS and SSH. Deselect HTTP.
4. Click OK.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command for all low privileged admin users:
# config system interface
# edit port{Management Port Integer #}
# set allowaccess ping https ssh
# end

Note: When a protocol is added or removed, the entire list of protocols must be typed in again. For example, to add PING to an access list of HTTPS and SSH, use the following CLI command:
# set allowaccess https ssh ping