FortiGate Hardening Checklist: Essential Security Best Practices

A firewall is one of the most critical security components in any network. A poorly configured FortiGate can expose management interfaces, allow weak authentication, or leave unnecessary services accessible from untrusted networks.

This checklist provides a practical baseline for hardening FortiGate firewalls. Each item below should be reviewed as part of every new deployment and during periodic security assessments.

Administration Security

• Change the default administrator account.
• Use unique administrator accounts.
• Enable Multi-Factor Authentication (MFA).
• Restrict management access to trusted IP addresses.
• Use dedicated management interfaces.
• Disable unused administrative protocols.
• Use SSH instead of Telnet.
• Use HTTPS with trusted certificates.
• Disable HTTP management access.
• Configure administrator password policies.

Firmware and Updates

• Keep FortiOS updated.
• Monitor Fortinet PSIRT advisories.
• Verify firmware integrity before installation.
• Maintain a documented upgrade process.

Network Hardening

• Disable unused interfaces.
• Remove unnecessary firewall policies.
• Apply the principle of least privilege.
• Restrict Local-In policies.
• Disable unused services on interfaces.
• Review NAT policies.
• Segment critical networks.

VPN Security

• Use strong encryption algorithms.
• Enable MFA for remote VPN users.
• Restrict VPN access by user groups.
• Disable SSL VPN if not required.
• Review VPN portal permissions.

Logging and Monitoring

• Enable security event logging.
• Forward logs to a centralized SIEM.
• Monitor administrator logins.
• Review failed authentication attempts.
• Generate alerts for critical security events.

Security Profiles

• Enable Intrusion Prevention (IPS).
• Enable AntiVirus inspection.
• Enable Application Control.
• Enable Web Filtering.
• Configure DNS Filtering.
• Use SSL/TLS inspection where appropriate.

Certificates and Encryption

• Remove weak TLS versions.
• Disable insecure cipher suites.
• Use trusted CA certificates.
• Rotate certificates before expiration.

Configuration Protection

• Encrypt configuration backups.
• Store backups securely.
• Test configuration restoration.
• Maintain configuration version history.

Continuous Review

• Perform periodic configuration reviews.
• Run vulnerability assessments.
• Review administrator permissions.
• Audit firewall policies regularly.
• Validate security baselines after every major change.

Many of these recommendations also apply to other network security devices. You can further strengthen your environment by implementing legacy authentication blocking, reviewing your identity security baseline, and applying additional hardening guidance across servers and endpoints.

Hardening is not a one-time activity. Regular reviews, firmware updates, configuration audits, and continuous monitoring are essential to maintaining a secure FortiGate deployment. Fortinet's own hardening guidance recommends reducing the attack surface, limiting administrative access, enabling logging, and keeping systems updated as part of an ongoing security program.