The 40-Point FortiGate Audit Checklist
The same checklist Ogma's NSE7 engineers use on customer audits. Forty checks across six domains — admin hardening, rule hygiene, SSL inspection, security profiles, VPN and logging — each with the exact CLI command or GUI path to verify it.
Read-only from start to finish. Run it from a config backup or a read-only admin account. Nothing touches production.
What's inside
Three tabs. Open, fill in Pass / Fail, read your score.
Tab 1
README
How to run the audit read-only, severity legend, and how the score is weighted.
Tab 2
Checklist (40 checks)
Every check with its verification command or GUI path, severity, why it matters, and Pass / Fail / Evidence columns. Filterable by domain.
Tab 3
Score
Failures per domain by severity and a weighted overall score — calculated automatically as you fill in results.
What the 40 checks cover
The same six domains as an Ogma audit engagement.
8 checks
Admin & Mgmt Plane
WAN admin access, trusted hosts, MFA, default accounts, lockout, SNMP.
8 checks
Policy & Rules
Any-any rules, exposed RDP/SMB, shadowed and zero-hit rules, logging, expiry.
6 checks
SSL/TLS Inspection
Deep inspection scope, CA trust, untrusted certs, exemptions, QUIC.
6 checks
Profiles & FortiGuard
Licence currency, IPS on VIPs, AV, web and DNS filtering, app control.
6 checks
VPN & SD-WAN
VPN MFA, SSL-VPN exposure, IPsec proposals, VPN segmentation, failover.
6 checks
Logs, Firmware & HA
PSIRT patch level, CERT-In 180-day retention, NTP, alerts, backups, HA sync.
Run it yourself — or have us run it
Most FortiGates drift. Rules accumulate, inspection gets switched off "temporarily", firmware falls behind. This checklist gives your team a defensible baseline in an afternoon — and gives auditors something concrete to look at.
If you would rather have an NSE7 engineer run it, write the executive and technical reports, and re-check the high-severity fixes 30 days later, that is our FortiGate Best Practices Audit.
📦 In the file
- ✅ 40 checks, 6 domains
- ✅ CLI command or GUI path for every check
- ✅ High / Medium / Low severity
- ✅ Pass / Fail / N/A + evidence columns
- ✅ Auto-calculated domain and overall score
- ✅ Read-only — safe on production
Common questions
If yours isn't here, mail [email protected] and an engineer will reply.
Will running these checks affect my firewall?
No. Every check is a read — a show or get command, or a look at a GUI page. You can do the whole audit from a configuration backup without logging in to the device at all.
Which FortiOS versions does it cover?
It is written for FortiOS 7.x. Most checks apply to older releases too; menu paths and a few command names differ slightly between versions.
Is this the same as a CIS benchmark?
It overlaps with the CIS FortiGate benchmark but is shorter and prioritised by what we actually see exploited or flagged in Indian audits. Use the full CIS benchmark if your auditor requires it line by line.
Can Ogma run the audit for us?
Yes. Our FortiGate Best Practices Audit is run by NSE7 engineers from a read-only account, with executive and technical reports, a remediation roadmap and a free 30-day re-check.