Detections
Analytics

FGFW-ND-000265 - The FortiGate device must implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.

Information

This requires the use of secure protocols instead of their unsecured counterparts, such as SSH instead of telnet, SCP instead of FTP, and HTTPS instead of HTTP. If unsecured protocols (lacking cryptographic mechanisms) are used for sessions, the contents of those sessions will be susceptible to eavesdropping, potentially putting sensitive data (including administrator passwords) at risk of compromise and potentially allowing hijacking of maintenance sessions.

Solution

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Network, Interfaces.
2. Click the interface designated for device management traffic and pick Edit.
3. On Administrative Access, select HTTPS and SSH. Deselect HTTP.
4. Click OK.

or

1. Open a CLI console, via SSH or available from the GUI.
2. Run the following command for all low privileged admin users:
 # config system interface
 # edit port{Management Port Integer #}
 # set allowaccess ping https ssh
 # end

Note: When a protocol is added or removed, the entire list of protocols must be typed in again. For example, to add PING to an access list of HTTPS and SSH, use the following CLI command:
 # set allowaccess https ssh ping

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_FN_FortiGate_Firewall_Y23M07_STIG.zip

Item Details

Category: MAINTENANCE

References: 800-53|MA-4(6), CAT|I, CCI|CCI-003123, Rule-ID|SV-234212r879785_rule, STIG-ID|FGFW-ND-000265, Vuln-ID|V-234212

Plugin: FortiGate

Control ID: 1326dc1b3858687d3f761bd0f9a1bbd88fa8ec23207b70176479abd4cea2febe