! PermitANY — Fortinet FortiGate Security Hardening
! CIS Benchmark-aligned hardening for FortiGate firewalls: admin access restrictions, TLS policy, password policy, unused service disablement, and audit logging.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
# FortiGate Security Hardening — FGT-EDGE-01
!
config system global
    set hostname FGT-EDGE-01
    set admin-sport 443
    set admin-ssh-port 22
    set admintimeout 10

    set admin-http-redirect enable

    set admin-https-ssl-versions tlsv1-2 tlsv1-3
    set strong-crypto enable
    set password-policy-expire 90
    set password-policy-min-length 12
    set password-policy-must-contain upper-case-letter lower-case-letter number non-alphanumeric
    set admin-lockout-threshold 5
    set admin-lockout-duration 300

    set pre-login-banner enable

    set cfg-save automatic
    set log-uuid-policy enable
end
!

config system replacemsg admin pre-admin-banner
    set msg "AUTHORIZED ACCESS ONLY. All activity is logged."
end

!
config system admin
    edit admin

        set trusthost{{@index}} 10.0.0.0 255.255.255.0


        set gui-ignore-release-overview-version enable

    next
end
!
# Disable unnecessary services
config system settings
    set gui-cdn-usage disable
end
!

config system interface
    edit any
        set allowaccess ping https ssh
    next
end

!

config log eventfilter
    set admin enable
    set auth enable
    set system enable
    set user enable
    set vpn enable
end

!

config log syslogd setting
    set status enable
    set server 10.0.0.200
    set mode udp
    set port 514
    set facility local6
    set format default
end
config log syslogd filter
    set severity information
    set forward-traffic enable
    set local-traffic enable
    set sniffer-traffic disable
    set voip disable
end

!
# SNMPv3 (disable v1/v2c)
config system snmp community
end
config system snmp sysinfo
    set status enable
end