Detections
Analytics
FGFW-ND-000200 - The FortiGate device must prohibit the use of all unnecessary and/or non-secure functions, ports, protocols, and/or services.
Information
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable unused or unnecessary physical and logical ports/protocols on information systems.Network devices are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component.
To support the requirements and principles of least functionality, the network device must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved. Some network devices have capabilities enabled by default; if these capabilities are not necessary, they must be disabled. If a particular capability is used, then it must be documented and approved.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Log in to the FortiGate GUI with Super-Admin privilege.1. Click Policy and Objects.
2. Click IPv4 or IPv6 Policy.
3. Click +Create New.
4. Name the policy, and then select Incoming and Outgoing Interfaces.
5. Create policies with authorized sources and destinations.
6. Set action to DENY.
7. Ensure Enable this policy is toggled to right.
8. Click OK.
9. Ensure a policy is created for each interface and that every PPSM CAL and VA mitigation is covered.
Traffic is denied by default and policies must be configured to allow traffic that meets PPSM CAL and VA guidelines.
or
Log in to the FortiGate GUI with Super-Admin privilege.
1. Open a CLI console, via SSH or available from the GUI.
2. Run the following
# config system interface
# edit {INTERFACE-NAME}
# set {DHCP-RELAY-SERVICE | PPTP-CLIENT | ARPFORWARD | BROADCAST-FORWARD | L2FORWARD | ICMP-REDIRECT | VLANFORWARD | STPFORWARD | LLDP-TRANSMISSION} disable
# end
Create a new line for each service in {} that needs to be removed.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_FN_FortiGate_Firewall_Y23M07_STIG.zip
Item Details
Audit Name: DISA Fortigate Firewall NDM STIG v1r4
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-7b., CAT|I, CCI|CCI-000382, Rule-ID|SV-234199r879588_rule, STIG-ID|FGFW-ND-000200, Vuln-ID|V-234199
Plugin: FortiGate
Control ID: 1520c1ef33be3486a93ef50f5b16d744924807e105eaa6081fce19e1a2b7b4a4