The 40-Point FortiGate Configuration Audit Checklist (2026)
Published 12 Oct 2026
· By
Pawan Sharma
· Network Security
· 14 min read
A FortiGate is never more secure than on the day it goes live. After that, it drifts. A vendor needs "temporary" access and gets an any-any rule. SSL inspection breaks a banking portal and gets switched off "for now". Firmware falls two major releases behind because nobody wants to own the maintenance window. Three years later, the box is still green on the dashboard — and quietly letting through most of what it was bought to stop.
This is the checklist our NSE7 engineers run when a customer asks us to audit a FortiGate that has been in production for a while. Forty checks, six domains, severity-rated. It pairs with a free FortiGate Audit Checklist (Excel) that adds the exact CLI or GUI path to verify each check, a pass/fail/evidence column, and a severity-weighted score — so your own team can run the audit in an afternoon.
🔐 Domain 1
Admin & Mgmt Plane
8 checks
📜 Domain 2
Policy & Rules
8 checks
🔍 Domain 3
SSL/TLS Inspection
6 checks
🛡️ Domain 4
Profiles & FortiGuard
6 checks
🌐 Domain 5
VPN & SD-WAN
6 checks
📦 Domain 6
Logs, Firmware, HA
6 checks
How to use this: run it read-only. Every check below can be verified from a config backup or a read-only admin account — nothing here generates traffic or changes the device. Severity reflects what we see exploited or audited most often in Indian environments; your risk register may weigh things differently.
Domain 1 — Admin & Management-Plane Hardening (8 checks)
Where most breaches of the firewall itself start
The box that guards the network must not be reachable from it
Almost every serious FortiGate compromise of the last few years started at the management plane or the SSL-VPN portal — an internet-exposed admin interface, a reused password, or an unpatched pre-auth bug. These eight checks close that door.
- 01No admin access (HTTPS, SSH, HTTP, Telnet) on any WAN or untrusted interface. Check
allowaccessunder every interface inconfig system interface.High - 02Trusted hosts set on every admin account — restricted to a management subnet or jump host, not
0.0.0.0/0.High - 03MFA on every admin account (FortiToken or RADIUS/SAML with MFA). Shared "admin" logins are a finding on their own.High
- 04Default
adminaccount renamed or disabled, with named individual accounts and least-privilege admin profiles.Medium - 05Password policy and lockout enforced —
config system password-policyenabled, plusadmin-lockout-thresholdandadmin-lockout-durationset inconfig system global.Medium - 06Idle timeout of 10 minutes or less (
admintimeout),strong-cryptoenabled, HTTP redirected to HTTPS.Low - 07SNMP is v3 only — no v1/v2c communities, and certainly no community called
public.Medium - 08Login banner and maintainer account reviewed — pre-login banner set for legal notice,
admin-maintainerdisabled where physical access isn't controlled.Low
Domain 2 — Policy & Rule Hygiene (8 checks)
Bloated policy is the #1 FortiGate risk we find
Every rule should have an owner, a reason and a hit count
Rule bases grow by accretion. Nobody deletes a rule because nobody is sure what will break. The result is a policy table where the rule that actually matches traffic is not the one anyone thinks it is.
- 09No any-any-ALL allow rules — source
all, destinationall, serviceALL, action accept. Each one found is a separate finding.High - 10No inbound VIPs exposing RDP, SMB, SSH or database ports to the internet. Check every VIP and port-forward against its policy.High
- 11Shadowed and redundant rules removed — a broader rule above a narrower one makes the narrower one dead code. FortiManager's policy consistency check finds these fast.Medium
- 12Zero-hit rules reviewed — rules with no hits in 90 days are disabled, then deleted after a further 30 days of silence.Medium
- 13Logging on every allow rule (
logtraffic allor at leastutm), and implicit-deny logging enabled.Medium - 14Internet-bound rules carry security profiles — an outbound accept rule with no IPS, AV or web filter is just routing.High
- 15Temporary and vendor rules have an expiry — a schedule or a ticket reference in the comment, not "temp" from 2023.Low
- 16Unused address and service objects cleaned up (reference count of zero), and rules commented with owner and purpose.Low
Domain 3 — SSL/TLS Inspection (6 checks)
The feature most often disabled "temporarily" and forgotten
Without inspection, most of your UTM licence sees nothing
The large majority of web traffic is encrypted. IPS, antivirus, web filtering by URL path and DLP all need to see inside it. A FortiGate doing only certificate inspection is paying for a full bundle and using a fraction of it.
- 17Deep inspection applied on outbound user traffic — not just
certificate-inspectioneverywhere.High - 18Inspection CA is trusted by endpoints — ideally an enterprise-CA-signed subordinate pushed by GPO/Intune, so users never see certificate warnings they learn to click through.Medium
- 19Untrusted and expired server certificates are blocked, not allowed — check
untrusted-server-certandexpired-server-certin the SSL/SSH profile.Medium - 20Exemption list is deliberate and short — finance and health categories exempt for privacy, specific pinned apps exempt by FQDN; no blanket subnet exemptions.Medium
- 21QUIC handled — blocked via application control so browsers fall back to TCP/TLS that the FortiGate can inspect (unless your FortiOS version and profile inspect QUIC natively).Medium
- 22Inbound inspection on published servers — VIP rules to internal web servers use the server certificate for inbound inspection so IPS can see attacks.Low
Domain 4 — Security Profiles & FortiGuard (6 checks)
Paid for vs. actually enforced
Licences that are valid but not applied protect nothing
- 23All FortiGuard services licensed and current — check the License Information widget and
diagnose autoupdate versionsfor signature dates within the last day or two.High - 24IPS sensor applied on every inbound VIP policy and on outbound user traffic, with botnet C&C connections set to block.High
- 25Antivirus profile applied on web, mail and file-transfer flows, with outbreak prevention and FortiSandbox/cloud sandbox where licensed.Medium
- 26Web filter blocks the high-risk categories — malicious websites, phishing, newly registered and newly observed domains, proxy avoidance.Medium
- 27DNS filter with botnet C&C domain blocking applied on the policies carrying user DNS traffic.Medium
- 28Application control blocks high-risk apps — remote-access tools, P2P, anonymisers — with explicit allow-list exceptions for the ones IT actually uses.Medium
Domain 5 — VPN & SD-WAN (6 checks)
Remote access is the front door
The SSL-VPN portal is where attackers look first
Fortinet's SSL-VPN has been the target of several critical pre-authentication vulnerabilities, and Fortinet has been steering customers towards IPsec and ZTNA for remote access in recent FortiOS releases. If you still run SSL-VPN, treat it as your highest-exposure service.
- 29Remote-access VPN has MFA for every user and authenticates against a directory, not local FortiGate users.High
- 30SSL-VPN migration plan exists — either moved to IPsec dial-up / ZTNA, or SSL-VPN is restricted (geo-limited, no web-mode, patched to the latest fixed release).High
- 31IPsec uses IKEv2 and strong proposals — AES-GCM or AES-256 with SHA-256+, DH group 14 or higher (19–21 preferred); no DES/3DES/MD5, no aggressive mode with pre-shared keys.Medium
- 32VPN users land in a restricted zone — policies from the VPN interface allow only the apps each group needs, not the whole LAN.Medium
- 33SD-WAN SLA probes match reality — health-check targets are reachable, thresholds reflect the actual application (voice vs. bulk), and members fail over as designed.Low
- 34Failover has been tested in the last 12 months — link failure and tunnel failure, with the result written down.Low
Domain 6 — Logging, Firmware & Resilience (6 checks)
What auditors and CERT-In actually ask for
If it isn't logged, it didn't happen — and you can't prove otherwise
- 35Firmware on a supported, patched release with no open Fortinet PSIRT advisories rated critical or high for your version. Check fortiguard.com/psirt against
get system status.High - 36Logs leave the box — to FortiAnalyzer, a SIEM or syslog — and are retained for at least 180 days within India, as the CERT-In April 2022 directions require.High
- 37NTP configured and in sync — log timestamps that are off by minutes make incident timelines worthless.Medium
- 38Admin and config-change events alerted — an automation stitch or SIEM rule fires on admin login failures and configuration changes.Medium
- 39Configuration backed up automatically and off-box, encrypted, with at least one restore tested.Medium
- 40HA pair healthy and in sync —
get system ha statusshows both members in sync, heartbeat links redundant, and both units carrying matching licences.Medium
How to Score Your Result
Count your failures by severity. In our experience, a FortiGate that has been in production for two or more years without a review typically fails a handful of the High checks and close to half of the Medium ones — most often #9, #12, #17, #30 and #36.
- Any High failure in Domain 1 or Domain 5 — treat it as an open incident. These are the paths attackers use to take over the firewall itself.
- Three or more High failures elsewhere — schedule a remediation sprint this quarter; the device is not enforcing the policy you think it is.
- Only Medium and Low failures — good baseline. Fix them in normal change windows and re-run the checklist every six months.
✅ Key Takeaways
- Management plane first. No admin access from untrusted interfaces, trusted hosts and MFA on every admin — that alone closes the most-exploited path.
- Rules need owners and hit counts. Any-any rules, exposed RDP and zero-hit rules are where drift hides.
- Inspection off means licence wasted. Without deep inspection, IPS, AV and web filtering see only a fraction of your traffic.
- Valid licence ≠ enforced protection. Check profiles are actually attached to the policies carrying traffic.
- Treat SSL-VPN as your riskiest service. MFA everywhere and a migration plan towards IPsec or ZTNA.
- Logs off-box for 180 days, in India. It's the CERT-In requirement and the first thing an incident responder will ask for.
Download the FortiGate Audit Checklist (Excel)
All 40 checks with the exact CLI command or GUI path to verify each one, a pass / fail / evidence column, severity weighting and an auto-calculated score per domain. Hand it to your team, or to your auditor, and get a defensible baseline in an afternoon.
🔥 NSE7-Certified Audit
Rather have us run it?
Ogma's NSE7 engineers run this audit from a read-only account or a config export — no traffic, no downtime. You get an executive summary for leadership, a technical findings report for IT, a sequenced remediation roadmap, and a free re-check of high-severity findings 30 days later.
Stay ahead of cyber threats
One short email a week — curated Indian cybersecurity news, Fortinet releases, DPDPA updates. No fluff.
