The FortiGate device must implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.

This requires the use of secure protocols instead of their unsecured counterparts, such as SSH instead of telnet, SCP instead of FTP, and HTTPS instead of HTTP. If unsecured protocols (lacking cryptographic mechanisms) are used for sessions, the contents of those sessions will be susceptible to eavesdropping, potentially putting sensitive data (including administrator passwords) at risk of compromise and potentially allowing hijacking of maintenance sessions.

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Network, Interfaces. 2. Click the interface designated for device management traffic. 3. On Administrative Access, verify HTTPS and SSH are selected.

If HTTPS and SSH are not selected for administrative access, this is a finding.

or

1. Open a CLI console, via SSH or available from the GUI. 2. Run the following command for all low privileged admin user: # show full-configuration system interface port{Management Port Integer #} | grep -i allowaccess

The output should include: set allowaccess ping https ssh

If https and ssh are not returned, this is a finding. If http is returned, this is a finding.

Log in to the FortiGate GUI with Super-Admin privilege.

1. Click Network, Interfaces. 2. Click the interface designated for device management traffic and pick Edit. 3. On Administrative Access, select HTTPS and SSH. Deselect HTTP. 4. Click OK.

or

1. Open a CLI console, via SSH or available from the GUI. 2. Run the following command for all low privileged admin users: # config system interface # edit port{Management Port Integer #} # set allowaccess ping https ssh # end

Note: When a protocol is added or removed, the entire list of protocols must be typed in again. For example, to add PING to an access list of HTTPS and SSH, use the following CLI command: # set allowaccess https ssh ping