Check the CIS compliance of a FortiGate
Cyberwatch evaluates the compliance of FortiGate firewalls with the CIS FortiGate 7.4.x Benchmark v1.0.1, published by the CIS in January 2026.
The 64 recommendations of the benchmark are available as compliance rules. 61 of them are checked automatically from the configuration of the FortiGate, read through its REST API. The other three depend on your organization and must be checked manually.
Add the FortiGate
Compliance is evaluated on a FortiGate added with the FortiGate (API) connector, directly or through a FortiManager. After its first scan, the asset has the FortiOS operating system, to which the rules of the benchmark apply.
A FortiGate scanned with SNMP also has the FortiOS system, but its rules are not evaluated: SNMP does not give access to the configuration.
The read-only profile prepared for the connector is enough, except for the administrator accounts, which it does not always allow reading: rules 2.4.1 and 2.4.2 then have the Skipped status, with the reason.
Associate the repositories
A new FortiGate (API) automatically receives the CIS_Benchmark_level_1 repository, which gathers the 39 level 1 recommendations.
To also evaluate the 25 level 2 recommendations, add the CIS_Benchmark_level_2 repository, or CIS_Benchmark, which gathers both levels. These repositories are present by default in Cyberwatch.
How the evaluation works
At each evaluation, Cyberwatch reads the configuration of the FortiGate through its API, read-only, then evaluates the rules. The configuration is not stored. The evaluation takes place every 30 days by default, according to the policy of the asset.
The tables specific to a VDOM, such as firewall policies or security profiles, are read for each VDOM. When there are several of them, each finding indicates its VDOM.
If the FortiGate does not respond, or rejects the API key, the evaluation fails and the rules keep the result of the previous evaluation. If a configuration table cannot be read (read denied by the profile, missing from this version of FortiOS, or incomplete), only the rules that depend on it have the Skipped status, with the reason.
The rules that relate to objects give one finding per object, visible in the “Compliance” tab of the asset: per firewall policy, interface, zone, security profile, administrator account or SNMPv3 user. The others give the value read for each setting, followed by the expected value when it differs.
Firewall policies and security profiles
The recommendations on security profiles only consider the active firewall policies that accept traffic and inspect it: a profile is only taken into account if the policy enables security profiles (utm-status enable), directly or through a profile group. The profiles that no policy applies are not evaluated.
Without a firewall policy in their scope, these recommendations are Success. If policies exist but none applies a profile of the expected type, the recommendation is Failed. A profile that is applied but cannot be found in its VDOM gives a finding that is not evaluated.
A firewall policy leads to the Internet when its destination is an interface with the WAN role, a zone or an SD-WAN zone that contains one, or any. Without an interface with the WAN role, the recommendations on policies to the Internet (4.1.1 and 4.3.3) have the Skipped status.
Only the firewall policies (Firewall Policy) are read: the security policies of the policy-based NGFW mode are not evaluated.
Recommendations checked automatically
| Rule | Level | Check |
|---|---|---|
| CIS-FortiGate-1.1 | 1 | A primary or secondary DNS server is configured |
| CIS-FortiGate-1.2 | 1 | Each zone blocks traffic between its interfaces (intrazone deny) |
| CIS-FortiGate-1.3 | 1 | No active interface with the WAN role allows administration over PING, HTTPS, HTTP, SSH, SNMP, RADIUS accounting or Telnet, in IPv4 as well as in IPv6. Access from a FortiManager (fgfm) remains allowed |
| CIS-FortiGate-2.1.1 | 1 | pre-login-banner is enabled |
| CIS-FortiGate-2.1.2 | 1 | post-login-banner is enabled |
| CIS-FortiGate-2.1.4 | 1 | NTP synchronization is enabled and a reachable NTP server is selected |
| CIS-FortiGate-2.1.5 | 1 | The hostname is neither the serial number nor the model name |
| CIS-FortiGate-2.1.6 | 2 | FortiGuard does not offer a more recent patch of the installed FortiOS branch |
| CIS-FortiGate-2.1.7 | 2 | auto-install-config and auto-install-image are disabled |
| CIS-FortiGate-2.1.8 | 2 | ssl-static-key-ciphers is disabled |
| CIS-FortiGate-2.1.9 | 2 | strong-crypto is enabled |
| CIS-FortiGate-2.1.10 | 1 | HTTPS administration only accepts TLS 1.3 (admin-https-ssl-versions tlsv1-3) |
| CIS-FortiGate-2.1.11 | 2 | gui-cdn-usage is enabled |
| CIS-FortiGate-2.1.12 | 1 | log-single-cpu-high is enabled |
| CIS-FortiGate-2.1.13 | 2 | gui-display-hostname is disabled |
| CIS-FortiGate-2.2.1 | 1 | The password policy is enabled, covers administrator passwords and IPsec keys, and requires at least 14 characters |
| CIS-FortiGate-2.2.2 | 1 | admin-lockout-threshold is at most 3, and admin-lockout-duration at most 900 seconds |
| CIS-FortiGate-2.3.1 | 1 | The SNMP agent is enabled, without SNMPv1/v2c community, with at least one active SNMPv3 user |
| CIS-FortiGate-2.3.2 | 2 | Each active SNMPv3 user is restricted to specific hosts (notify-hosts) |
| CIS-FortiGate-2.3.3 | 2 | No active SNMPv3 user can query the agent (queries disable) |
| CIS-FortiGate-2.3.4 | 1 | The SNMP agent is enabled, trap-free-memory-threshold is at least 20 and trap-freeable-memory-threshold at most 50 |
| CIS-FortiGate-2.4.1 | 1 | No administrator account is named admin |
| CIS-FortiGate-2.4.2 | 1 | Each administrator account is restricted to trusted hosts. When only its IPv4 hosts are, the finding invites to check IPv6 access |
| CIS-FortiGate-2.4.4 | 1 | admintimeout is at most 5 minutes |
| CIS-FortiGate-2.4.5 | 1 | No active interface allows administration over HTTP or Telnet |
| CIS-FortiGate-2.4.6 | 1 | Each VDOM has at least one active local-in policy |
| CIS-FortiGate-2.4.7 | 1 | The administration ports are not 443 and 80, and admin-https-redirect is disabled |
| CIS-FortiGate-2.4.8 | 1 | Each active local-in policy that accepts traffic applies virtual patching |
| CIS-FortiGate-2.5.1 | 2 | High availability is enabled |
| CIS-FortiGate-2.5.2 | 1 | HA monitors at least one interface (monitor) |
| CIS-FortiGate-2.5.3 | 1 | HA reserves a management interface, with its gateway |
| CIS-FortiGate-2.5.4 | 2 | The HA group-id is not 0 |
| CIS-FortiGate-3.2 | 1 | No active firewall policy that accepts traffic uses the ALL service |
| CIS-FortiGate-3.3 | 1 | Active firewall policies deny incoming traffic, on all services, and outgoing traffic of the risky ISDB services listed by the benchmark. Negated policies (negate) do not count |
| CIS-FortiGate-3.4 | 1 | Each active firewall policy that accepts traffic logs all its sessions (logtraffic all), each deny policy logs the denied traffic, and so does the implicit deny policy of each VDOM (fwpolicy-implicit-log) |
| CIS-FortiGate-4.1.1 | 2 | The IPS profiles of the policies to the Internet block connections to botnets |
| CIS-FortiGate-4.1.2 | 1 | Each policy that accepts traffic applies an IPS profile |
| CIS-FortiGate-4.2.1 | 2 | FortiGuard updates are enabled in automatic mode |
| CIS-FortiGate-4.2.2 | 2 | Each policy that accepts traffic applies an antivirus profile |
| CIS-FortiGate-4.2.3 | 2 | The applied antivirus profiles block outbreaks on each protocol they scan (outbreak-prevention block) |
| CIS-FortiGate-4.2.4 | 2 | Machine learning detection (machine-learning-detection) is enabled |
| CIS-FortiGate-4.2.5 | 2 | Detection of grayware is enabled |
| CIS-FortiGate-4.2.6 | 1 | FortiGuard sandbox inline scanning is enabled, and the applied antivirus profiles use it in blocking mode on each protocol they scan |
| CIS-FortiGate-4.2.7 | 2 | The applied antivirus profiles are in proxy mode and disarm the content (CDR) |
| CIS-FortiGate-4.3.1 | 2 | The applied DNS filters block botnet domains |
| CIS-FortiGate-4.3.2 | 1 | The applied DNS filters log all requests (log-all-domain) |
| CIS-FortiGate-4.3.3 | 1 | Each policy to the Internet applies a DNS filter |
| CIS-FortiGate-4.4.1 | 1 | The applied web filters block the Malicious Websites, Phishing and Spam URLs categories |
| CIS-FortiGate-4.5.1 | 1 | The applied application control profiles block the P2P and Proxy categories: the first entry that targets each of them blocks it entirely, without filter |
| CIS-FortiGate-4.5.2 | 2 | The applied application control profiles block applications on a non-default port |
| CIS-FortiGate-4.5.3 | 1 | The applied application control profiles do not allow any category without logging it |
| CIS-FortiGate-4.5.4 | 1 | Each policy that accepts traffic applies an application control profile |
| CIS-FortiGate-5.1.1 | 1 | An active automation quarantines compromised hosts |
| CIS-FortiGate-5.2.1.1 | 2 | The Security Fabric is enabled and named, and logs are sent to FortiAnalyzer. The output gives the role of the FortiGate, root or downstream |
| CIS-FortiGate-6.1.1 | 2 | The SSL VPN presents a certificate other than those of Fortinet |
| CIS-FortiGate-6.1.2 | 2 | The SSL VPN only accepts TLS 1.2 and 1.3, with strong encryption |
| CIS-FortiGate-7.1.1 | 2 | All event types are logged |
| CIS-FortiGate-7.2.1 | 2 | Logs are sent to one of the syslog servers (syslogd to syslogd4), one of the FortiAnalyzer servers (fortianalyzer to fortianalyzer3) or FortiAnalyzer Cloud |
| CIS-FortiGate-7.3.1 | 1 | The logs sent to each active FortiAnalyzer are encrypted (enc-algorithm high) and reliable (reliable enable) |
| CIS-FortiGate-7.3.2 | 1 | The logs sent to each active syslog server are encrypted (enc-algorithm high) and reliable (mode reliable) |
| CIS-FortiGate-7.3.3 | 1 | Identical to 7.3.2, which the benchmark repeats |
The checks follow the audit procedure of the benchmark, including when it is strict: rule 2.1.10 requires TLS 1.3 only, and rule 2.2.2 a lockout duration of at most 900 seconds.
The output of rule 5.2.1.1 recalls what remains to be checked manually: the settings of FortiAnalyzer and the interfaces used by the devices of the Security Fabric. Rule 6.1.1 does not check that the certificate is signed by a trusted authority.
Recommendations that do not apply
Some recommendations have the Skipped status when they do not apply to the FortiGate:
- 1.3, without an active interface with the WAN role: the WAN ports must be identified manually;
- 2.1.6, when the FortiGate does not have the list of FortiOS versions, as it cannot reach FortiGuard;
- 2.5.2 to 2.5.4, on a FortiGate without high availability;
- 4.1.1 and 4.3.3, without an interface with the WAN role: the policies to the Internet cannot be identified;
- 6.1.1 and 6.1.2, without an active SSL VPN;
- 7.3.1, when the logs are sent to no FortiAnalyzer, and 7.3.2 and 7.3.3, when they are sent to no syslog server. The logging override by a VDOM is not read.
Recommendations to check manually
Three recommendations depend on your organization:
- 2.1.3, the time zone: its output gives the configured time zone;
- 2.4.3, the profiles of the administrator accounts;
- 3.1, the periodic review of unused firewall policies.
These rules have the Skipped status, with the “Manual verification required” mention followed by the reason. The page of each rule includes the CIS audit procedure.
Once a recommendation has been checked, it is possible to ignore the rule and to comment this choice.