What changed in Fortinet FortiGate Firewall NDM STIG V1R6V1R6 changes

Title

The FortiGate device must display the Standard Mandatory DoDW Notice and Consent Banner before granting access to the device.

Check text

Access the FortiGate GUI login page. Verify DoDDoW-approved banner is displayed on the login landing page. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the correct DoDDoW required banner text is not displayed, this is a finding. and Open a CLI console via SSH and connect to the FortiGate device: Verify the FortiGate CLI displays the Standard Mandatory DoDDoW Notice and Consent Banner before granting access to the system via SSH. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. At any time, the USG may inspect and seize data stored on this IS. Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the DoDDoW-approved banner is not displayed before granting access, this is a finding.

Discussion

Display of the DoDDoW-approved use notification before granting access to the network device ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users.

V-234169 in V1R6

Title

The FortiGate device must retain the Standard Mandatory DoDDoW Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.

Check text

1. Attempt to access the FortiGate device using HTTPS URL. 2. Verify Standard Mandatory DoDDoW Notice and Consent Banner is displayed and retained on the screen. 3. Verify a user has to explicitly ACCEPT the banner before to log on for further access. If Standard Mandatory DoDDoW Notice and Consent Banner is not retained, and a user is not forced to ACCEPT the banner to log on for further access, this is a finding. And, 1. Attempt to login to the FortiGate via SSH: 2. Enter username. 3. Verify the Standard Mandatory DoDDoW Notice and Consent Banner before prompting to enter a password. If Standard Mandatory DoDDoW Notice and Consent Banner is not retained before entering the password to log on for further access, this is a finding.

Discussion

The banner must be acknowledged by the administrator prior to the device allowing the administrator access to the network device. This ensures the administrator has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the administrator, DoDDoW will not be in compliance with system use notifications required by law. To establish acceptance of the network administration policy, a click-through banner at management session logon is required. The device must prevent further activity until the administrator executes a positive action to manifest agreement. In the case of CLI access using a terminal client, entering the username and password when the banner is presented is considered an explicit action of acknowledgement. Entering the username, viewing the banner, then entering the password is also acceptable.

V-234170 in V1R6

Discussion

The loss of connectivity to a particular authoritative time source will result in the loss of time synchronization (free-run mode) and increasingly inaccurate time stamps on audit events and other functions. Multiple time sources provide redundancy by including a secondary source. Time synchronization is usually a hierarchy; clients synchronize time to a local source while that source synchronizes its time to a more accurate source. The network device must utilize an authoritative time server and/or be configured to use redundant authoritative time sources. This requirement is related to the comparison done in CCI-001891. DoDDoW-approved solutions consist of a combination of a primary and secondary time source using a combination or multiple instances of the following: a time server designated for the appropriate DoDDoW network (NIPRNet/SIPRNet); United States Naval Observatory (USNO) time servers; and/or the Global Positioning System (GPS). The secondary time source must be located in a different geographic region than the primary time source.

V-234183 in V1R6

Title

The FortiGate device must use DoDW-approved Certificate Authorities (CAs) for public key certificates.

Check text

Log in to the FortiGate GUI with Super-Admin privilege. 1. Click "System". 2. Click "Certificates". 3. Verify CAs are approved providers. If the public key certificates are not from an approved service provider, this is a finding.

Fix text

1. Obtain CA certificate from a DoDDoW-approved provider. 2. Log in to the FortiGate GUI with Super-Admin privilege. 3. Click "System". 4. Click "Certificates". 5. Click "Import" in the toolbar. 6. Click CA Certificate. 7. On the Import CA Certificate page, select "Type File". 8. Locate the certificate file and upload the certificate file. 9. Click "OK" to import the certificate.

V-234198 in V1R6

CCIs

CCI-00204061

V-234209 in V1R6

Discussion

Unapproved mechanisms that are used for authentication to the cryptographic module are not validated and therefore cannot be relied upon to provide confidentiality or integrity, and DoDDoW data may be compromised. Network devices utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoDDoW requirements. However, authentication algorithms must configure security processes to use only FIPS-approved and NIST-recommended authentication algorithms.

V-234210 in V1R6

Check text

Log in to the FortiGate GUI with Super-Admin privilege. 1. Click "Network, Interfaces". 2. Click the interface designated for device management traffic. 3. On Administrative Access, verify HTTPS and SSH are selected, and HTTP is not. If HTTPS and SSH are not selected for administrative access, or HTTP is selected, this is a finding. or 1. Open a CLI console, via SSH or available from the GUI. 2. Run the following command: # show full-configuration system interface port{Management Port Integer #} | grep -i allowaccess The output should include: set allowaccess ping https ssh If the allowaccess parameter does not include https and ssh, this is a finding. If the allowaccess parameter includes http, this is a finding.

Fix text

Log in to the FortiGate GUI with Super-Admin privilege. 1. Click "Network, Interfaces". 2. Click the interface designated for device management traffic and pick "Edit". 3. On Administrative Access, select HTTPS and SSH. Deselect HTTP. 4. Click "OK". or 1. Open a CLI console, via SSH or available from the GUI. 2. Run the following command: # config system interface # edit port{Management Port Integer #} # set allowaccess ping https ssh # end Note: When adding or removing a protocol, the entire list of protocols must be typed again. For example, in an existing access list of HTTPS and SSH, if HTTP needs to be added, use the following CLI command: # set allowaccess https ssh ping http

Discussion

Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoDDoW data may be compromised. Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the internet) or an internal network. Currently, HMAC is the only FIPS-approved algorithm for generating and verifying message/data authentication codes in accordance with FIPS 198-1. Products that are FIPS 140-2 validated will have an HMAC that meets specification; however, the option must be configured for use as the only message authentication code used for authentication to cryptographic modules. Separate requirements for configuring applications and protocols used by each application (e.g., SNMPv3, SSHv2, NTP, HTTPS, and other protocols and applications that require server/client authentication) are required to implement this requirement. Where SSH is used, the SSHv2 protocol suite is required because it includes Layer 7 protocols such as SCP and SFTP, which can be used for secure file transfers.

V-234211 in V1R6

Check text

Verify the FortiGate device terminates all network connections when non-local device maintenance is complete. Log in to the FortiGate GUI with Super-Admin privilege. 1. Click "System". 2. Click "Settings". 3. Go to Administrative Settings. 4. Verify Idle Timeout is configured to 10 minutes. If the idle-timeout value is not 10 minutes, this is a finding. or 1. Open a CLI console, via SSH or available from the GUI. 2. Run the following command: # show full-configuration sys global | grep -i admintimeout The output should be: set admintimeout 10 If the admintimeout parameter is not set to 10 minutes, this is a finding.

Fix text

To configure the device to terminate all network connections when non-local maintenance is complete: Log in to the FortiGate GUI with Super-Admin privilege. 1. Click "System". 2. Click "Settings". 3. Go to Administrative Settings. 4. Enter the Idle Timeout value of 10. 5. Click Apply. or 1. Open a CLI console, via SSH or available from the GUI. 2. Run the following command: # config system global # set admintimeout 10 # end

CCIs

CCI-0008791133

V-234213 in V1R6

Check text

Log in to the FortiGate GUI with Super-Admin privilege. 1. Click "Policy and Objects". 2. Click" on IPv4 DoS Policy" or "IPv6 DoS Policy". 3. Identify the port designated for FortiGate device management. 4. Select the policy and click "Edit". 5. Verify appropriate L3 Anomalies and L4 Anomalies are configured to meet the organization requirement. 6. Verify the policy is Enabled. If appropriate DoS policies are not defined or are disabled, this is a finding.

Fix text

Log in to the FortiGate GUI with Super-Admin privilege. 1. Click "Policy and Objects". 2. Click "IPv4 DoS Policy" or "IPv6 DoS Policy". 3. Identify the port designated for FortiGate device management. 4. Click "+Create New". 5. Define the Incoming Interface, Source Address, Destination Address, and Services. 6. Configure L3 Anomalies, and L4 Anomalies to meet the organization requirement. 7. Click "OK".

Discussion

DoS prohibit a resource from being available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. This requirement addresses the configuration of network devices to mitigate the impact of DoS attacks that have occurred or are ongoing on device availability. For each network device, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or restricting the number of sessions the device opens at one time). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks. The security safeguards cannot be defined at the DoD-DoW level because they vary according to the capabilities of the individual network devices and the security controls applied on the adjacent networks (for example, firewalls performing packet filtering to block DoS attacks).

V-234217 in V1R6