FNFG-FW-000005 - The FortiGate firewall must use filters that use packet headers and packet attributes, including source and destination IP addresses and ports.

800-53|AC-4

CAT|I

CCI|CCI-001414

Rule-ID|SV-234133r611399_rule

STIG-ID|FNFG-FW-000005

Vuln-ID|V-234133

FNFG-FW-000015 - The FortiGate firewall must use organization-defined filtering rules that apply to the monitoring of remote access traffic for the traffic from the VPN access points.

800-53|AC-17(1)

CAT|II

CCI|CCI-000067

Rule-ID|SV-234134r611402_rule

STIG-ID|FNFG-FW-000015

Vuln-ID|V-234134

FNFG-FW-000020 - The FortiGate firewall must generate traffic log entries containing information to establish what type of events occurred.

800-53|AU-3

CCI|CCI-000130

Rule-ID|SV-234135r611405_rule

STIG-ID|FNFG-FW-000020

Vuln-ID|V-234135

FNFG-FW-000025 - The FortiGate firewall must generate traffic log entries containing information to establish when (date and time) the events occurred.

CCI|CCI-000131

Rule-ID|SV-234136r611408_rule

STIG-ID|FNFG-FW-000025

Vuln-ID|V-234136

FNFG-FW-000030 - The FortiGate firewall must generate traffic log entries containing information to establish the network location where the events occurred.

CCI|CCI-000132

Rule-ID|SV-234137r611411_rule

STIG-ID|FNFG-FW-000030

Vuln-ID|V-234137

FNFG-FW-000035 - The FortiGate firewall must generate traffic log entries containing information to establish the source of the events, such as the source IP address at a minimum.

CAT|III

CCI|CCI-000133

Rule-ID|SV-234138r611414_rule

STIG-ID|FNFG-FW-000035

Vuln-ID|V-234138

FNFG-FW-000040 - The FortiGate firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the firewall rule.

CCI|CCI-000134

Rule-ID|SV-234139r611417_rule

STIG-ID|FNFG-FW-000040

Vuln-ID|V-234139

FNFG-FW-000045 - In the event that communication with the central audit server is lost, the FortiGate firewall must continue to queue traffic log records locally. - disk status|diskfull

800-53|AU-5b.

CCI|CCI-000140

Rule-ID|SV-234140r863251_rule

STIG-ID|FNFG-FW-000045

Vuln-ID|V-234140

FNFG-FW-000045 - In the event that communication with the central audit server is lost, the FortiGate firewall must continue to queue traffic log records locally. - fortianalyzer|syslogd server

FNFG-FW-000050 - The FortiGate firewall must protect traffic log records from unauthorized access while in transit to the central audit server - enc-algorithm

800-53|AU-9

CCI|CCI-000162

Rule-ID|SV-234141r835165_rule

STIG-ID|FNFG-FW-000050

Vuln-ID|V-234141

FNFG-FW-000050 - The FortiGate firewall must protect traffic log records from unauthorized access while in transit to the central audit server. - set mode

FNFG-FW-000050 - The FortiGate firewall must protect traffic log records from unauthorized access while in transit to the central audit server. - set server

FNFG-FW-000055 - The FortiGate firewall must protect the traffic log from unauthorized modification of local log records.

CCI|CCI-000163

Rule-ID|SV-234142r611426_rule

STIG-ID|FNFG-FW-000055

Vuln-ID|V-234142

FNFG-FW-000060 - The FortiGate firewall must protect the traffic log from unauthorized deletion of local log files and log records.

CCI|CCI-000164

Rule-ID|SV-234143r611429_rule

STIG-ID|FNFG-FW-000060

Vuln-ID|V-234143

FNFG-FW-000065 - The FortiGate firewall must disable or remove unnecessary network services and functions that are not used as part of its role in the architecture.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-234144r611432_rule

STIG-ID|FNFG-FW-000065

Vuln-ID|V-234144

FNFG-FW-000070 - The FortiGate firewall must block outbound traffic containing denial-of-service (DoS) attacks to protect against the use of internal information systems to launch any DoS attacks against other networks or endpoints.

800-53|SC-5(1)

CCI|CCI-001094

Rule-ID|SV-234145r611435_rule

STIG-ID|FNFG-FW-000070

Vuln-ID|V-234145

FNFG-FW-000075 - The FortiGate firewall implementation must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.

800-53|SC-5(2)

CCI|CCI-001095

Rule-ID|SV-234146r611438_rule

STIG-ID|FNFG-FW-000075

Vuln-ID|V-234146

FNFG-FW-000085 - The FortiGate firewall must filter traffic destined to the internal enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL), Vulnerability Assessments (VAs) for that the enclave. - policy

800-53|SC-7a.

CCI|CCI-001097

Rule-ID|SV-234147r628789_rule

STIG-ID|FNFG-FW-000085

Vuln-ID|V-234147

FNFG-FW-000085 - The FortiGate firewall must filter traffic destined to the internal enclave in accordance with the specific traffic that is approved and registered in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL), Vulnerability Assessments (VAs) for that the enclave. - policy6

FNFG-FW-000090 - The FortiGate firewall must fail to a secure state if the firewall filtering functions fail unexpectedly - av-failopen

800-53|SC-24

CCI|CCI-001190

Rule-ID|SV-234148r611444_rule

STIG-ID|FNFG-FW-000090

Vuln-ID|V-234148

FNFG-FW-000090 - The FortiGate firewall must fail to a secure state if the firewall filtering functions fail unexpectedly - av-failopen-session

FNFG-FW-000090 - The FortiGate firewall must fail to a secure state if the firewall filtering functions fail unexpectedly - fail-open

FNFG-FW-000100 - The FortiGate firewall must send traffic log entries to a central audit server for management and configuration of the traffic log entries.

800-53|AU-4(1)

CCI|CCI-001851

Rule-ID|SV-234149r863248_rule

STIG-ID|FNFG-FW-000100

Vuln-ID|V-234149

FNFG-FW-000105 - If communication with the central audit server is lost, the FortiGate firewall must generate a real-time alert to, at a minimum, the SCA and ISSO.

800-53|AU-5(2)

CCI|CCI-001858

Rule-ID|SV-234150r852960_rule

STIG-ID|FNFG-FW-000105

Vuln-ID|V-234150

FNFG-FW-000110 - The FortiGate firewall must employ filters that prevent or limit the effects of all types of commonly known denial-of-service (DoS) attacks, including flooding, packet sweeps, and unauthorized port scanning.

800-53|SC-5

CCI|CCI-002385

Rule-ID|SV-234151r852961_rule

STIG-ID|FNFG-FW-000110

Vuln-ID|V-234151

FNFG-FW-000115 - The FortiGate firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.

800-53|SC-7(11)

CCI|CCI-002403

Rule-ID|SV-234152r852962_rule

STIG-ID|FNFG-FW-000115

Vuln-ID|V-234152

FNFG-FW-000120 - The FortiGate firewall must apply egress filters to traffic outbound from the network through any internal interface.

Rule-ID|SV-234153r852963_rule

STIG-ID|FNFG-FW-000120

Vuln-ID|V-234153

FNFG-FW-000125 - When employed as a premise firewall, FortiGate must block all outbound management traffic.

Rule-ID|SV-234154r852965_rule

STIG-ID|FNFG-FW-000125

Vuln-ID|V-234154

FNFG-FW-000130 - The FortiGate firewall must restrict traffic entering the VPN tunnels to the management network to only the authorized management packets based on destination address.

Rule-ID|SV-234155r852966_rule

STIG-ID|FNFG-FW-000130

Vuln-ID|V-234155

FNFG-FW-000135 - The FortiGate firewall must be configured to inspect all inbound and outbound traffic at the application layer.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-234156r611468_rule

STIG-ID|FNFG-FW-000135

Vuln-ID|V-234156

FNFG-FW-000145 - The FortiGate firewall must be configured to restrict it from accepting outbound packets that contain an illegitimate address in the source address field via an egress filter or by enabling Unicast Reverse Path Forwarding (uRPF).

Rule-ID|SV-234157r611471_rule

STIG-ID|FNFG-FW-000145

Vuln-ID|V-234157

FNFG-FW-000150 - The FortiGate firewall must generate an alert that can be forwarded to, at a minimum, the Information System Security Officer (ISSO) and Information System Security Manager (ISSM) when denial-of-service (DoS) incidents are detected - enc-algorithm

800-53|SI-4(5)

CCI|CCI-002664

Rule-ID|SV-234158r852967_rule

STIG-ID|FNFG-FW-000150

Vuln-ID|V-234158

FNFG-FW-000150 - The FortiGate firewall must generate an alert that can be forwarded to, at a minimum, the Information System Security Officer (ISSO) and Information System Security Manager (ISSM) when denial-of-service (DoS) incidents are detected. - set certificate

FNFG-FW-000150 - The FortiGate firewall must generate an alert that can be forwarded to, at a minimum, the Information System Security Officer (ISSO) and Information System Security Manager (ISSM) when denial-of-service (DoS) incidents are detected. - set mode

FNFG-FW-000150 - The FortiGate firewall must generate an alert that can be forwarded to, at a minimum, the Information System Security Officer (ISSO) and Information System Security Manager (ISSM) when denial-of-service (DoS) incidents are detected. - set server

FNFG-FW-000155 - The FortiGate firewall must allow authorized users to record a packet-capture-based IP, traffic type (TCP, UDP, or ICMP), or protocol.

800-53|AU-14(2)

CCI|CCI-001462

Rule-ID|SV-234159r611477_rule

STIG-ID|FNFG-FW-000155

Vuln-ID|V-234159

FNFG-FW-000160 - The FortiGate firewall must generate traffic log records when traffic is denied, restricted, or discarded.

800-53|AU-12c.

CCI|CCI-000172

Rule-ID|SV-234160r611480_rule

STIG-ID|FNFG-FW-000160

Vuln-ID|V-234160

FNFG-FW-000165 - The FortiGate firewall must generate traffic log records when attempts are made to send packets between security zones that are not authorized to communicate.

Detections

Analytics

DISA Fortigate Firewall STIG v1r3

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous

Added

Removed