Cyfora Tech Analyzer Report

Generated: 2026-05-04T20:33:27.758129
Technology: fortinet_api

Best Practices Compliance

Category Best Practice Domain Score Last Updated
Title: Time Zone should be UTC 0
Description: Accurate time is required for troubleshooting, certificate validation, and log correlation. Set the device time zone to UTC 0.
Technical implementation: Scope: The timezone configuration.
Scoring: Binary: 100 if Timezone is UTC 0 or 80 in Fortinet, 0 otherwise.
Implementation score: 100%
Title: NTP server should be configured
Description: For correctly logged time stamps in your logs you need to use 2 NTP servers. A primary to set the time and a secondary to make sure they match. Fortinet also has a fortigaurd ntp configuration setting wich is a group of ntp servers.
Technical implementation: Scope: The NTP server configuration.
Scoring: Binary: 100 if NTP server uses Fortigaurd as NTP server or if NTP server is custom with 2 servers configures, 0 otherwise.
Implementation score: 100%
Title: Admin login policy should be configured
Description: To prevent bruteforcing of an admin account limit the login attempts and when these get exceeded give a time-out for that user.
Technical implementation: Scope: Configuring the admin login lockout policy. Compliant when admin-lockout-threshold is >= 3 AND admin-lockout-duration is >= 300 seconds (5 minutes). Note: if not explicitly configured, defaults are assumed.
Scoring: Score = compliant / total * 100. Returns 100 if login failed attempts and the lockout time is correctly configured.
Implementation score: 50%
Title: Admin HTTPS port configuration should be secure
Description: Configure secure HTTPS settings for admin access by using non-default port, HTTPS redirect disabled, strong crypto enabled, and TLS 1.2+.
Technical implementation: Scope: Admin HTTPS configuration. Compliant when admin-sport is NOT the default 443, admin-https-redirect is disabled, strong-crypto is enabled, and admin-https-ssl-versions contains only tlsv1-2 and tlsv1-3.
Scoring: Binary: 100 if all HTTPS settings are correct, 0 otherwise.
Implementation score: 0%
Title: Admin SSH port configuration should be secure
Description: Configure secure SSH settings for admin access by using non-default port and disabling SSHv1.
Technical implementation: Scope: Admin SSH configuration. Compliant when admin-ssh-port is NOT the default 22 and admin-ssh-v1 is disabled.
Scoring: Binary: 100 if all SSH settings are correct, 0 otherwise.
Implementation score: 0%
Title: Automatic firmware update should be disabled
Description: To prevent unwanted downtimes or device restart disable the automatic update of the device.
Technical implementation: Scope: Configuring the automatic firmware upgrade setting. They are compliant when auto-firmware-upgrade is disabled.
Scoring: Score = compliant / total * 100. Returns 100 if login failed attempts and the lockout time is correctly configured.
Implementation score: 0%
Title: Admin default user should be disabled
Description: For security reasons it is best to rename the default admin account.
Technical implementation: Scope: users accounts that are configured. They are compliant when the default admin user is renamed or deleted
Scoring: Binary: 100 if default admin is removed, 0 otherwise.
Implementation score: 0%
Title: Second admin user should be configured
Description: For safety it is best to configure a second admin account that just exists in case you accidently lock out the main admin.
Technical implementation: Scope: users accounts that are configured. They are compliant when there are 2 super admins.
Scoring: Binary: 100 if 2 super admins are configured, 0 otherwise.
Implementation score: 100%
Title: Admin password policy should be configured
Description: To make unwanted acces harder configuring minimum password requirements is needed.
Technical implementation: Scope: Configuring the admin password policy, they are compliant when it is enabled with a minimum length of 15, require at least 1 lowercase letter, uppercase letter, special character, number and have reusing old password disabled.
Scoring: Score = compliant / total * 100. Returns 100 if password policy is correctly configured.
Implementation score: 100%
Title: Admin 2Factor login should be configured
Description: To make unwanted acces harder enabling admin 2fa is needed.
Technical implementation: Scope: Configuring the admin 2fa authentication, they are compliant when it is enabled.
Scoring: Score = compliant / total * 100. Returns 100 if all admins have 2fa configured.
Implementation score: 100%
Title: Admin login restriction should be configured
Description: To make unwanted acces harder configuring login location restrictions is needed.
Technical implementation: Scope: Configuring the admin login restriction authentication, they are compliant when it is enabled.
Scoring: Score = compliant / total * 100. Returns 100 if all admins have login restrictions configured.
Implementation score: 0%
Title: Admin server certificate should not be default
Description: To make unwanted acces harder configuring login location restrictions is needed. Replace the default admin server certificate with an organization-specific certificate to prevent man-in-the-middle attacks.
Technical implementation: Scope: Configuring the admin login restriction authentication, they are compliant when it is enabled.
Scoring: Score = compliant / total * 100. Returns 100 if all admins have login restrictions configured.
Implementation score: 0%
Title: SNMP configuration check
Description: To make unwanted acces harder configuring login location restrictions is needed.
Technical implementation: Scope: Configuring the SNMP, they are compliant when it is disabled, or when it only v3 is enabled.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all SNMPv3 are configured with hosts and a require a password.
Implementation score: 25%
Title: Global IPS configuration check
Description: With the OT Security Services license, OT-related IPS signatures can be used for detection. GUI visibility is optional; signatures should not be excluded.
Technical implementation: Scope: Configuring the Global IPS settings to exclude not signatures, they are compliant when it is none.
Scoring: Binary: 100 if exclude signatures is none, 0 otherwise.
Implementation score: 100%
Title: SSL-VPN should be disabled
Description: SSL-VPN should be disabled unless explicitly required for remote access. Enabling SSL-VPN without proper security controls increases the attack surface.
Technical implementation: Scope: Checking the SSL-VPN status, they are compliant when it is disabled.
Scoring: Binary: 100 if SSL-VPN is disabled, 0 if enabled.
Implementation score: 0%
Title: Management access should be restricted to dedicated interfaces
Description: Limit management protocols (HTTPS, SSH) to dedicated management interfaces only. Management access should not be enabled on WAN or untrusted interfaces.
Technical implementation: Scope: System interface configuration. Compliant when management-facing interfaces (typically WAN) do not include https or ssh in their allowaccess setting.
Scoring: Binary: 100 if no WAN/untrusted interfaces have https or ssh access, 0 otherwise.
Implementation score: 50%
Title: High availibility mode configuration check
Description: Active-passive is the most common and predictable HA mode for branch and perimeter deployments. It simplifies troubleshooting and avoids asymmetric traffic concerns.
Technical implementation: Scope: Configuring the High Availability mode. Compliant when mode = 'a-p' (active-passive). Note: Check uses literal token match; ensure device outputs 'a-p' not 'active-passive'.
Scoring: Binary: 100 if Active-passive, 0 otherwise.
Implementation score: 100%
Title: High availibility mode configuration check
Description: Two heartbeat links provide redundancy and reduce the likelihood of split-brain or failover instability due to a single cable/switch failure.
Technical implementation: Scope: Configuring the High availibility Heartbeat devices, they are compliant when there are 2.
Scoring: Binary: 100 if Active-passive, 0 otherwise.
Implementation score: 0%
Title: High availibility mode configuration check
Description: Monitoring should reflect real service health (core reachability). Avoid triggering failover due to WAN jitter or heartbeat-specific paths.
Technical implementation: Scope: Configuring the High availibility monitor interfaces, they are compliant when they are not the Heartbeat devices or wan interfaces.
Scoring: Binary: 100 if Active-passive, 0 otherwise.
Implementation score: 100%
Title: High availibility mode configuration check
Description: Session pickup reduces disruption during failover by synchronizing sessions between cluster members.
Technical implementation: Scope: Configuring the High availibility session pickup, they are compliant when it is turned on.
Scoring: Binary: 100 if turned on, 0 otherwise.
Implementation score: 100%
Title: NGFW-mode configuration check
Description: Profile-based mode standardizes UTM configuration and aligns with most operational models using security profiles on policies.
Technical implementation: Scope: Configuring the NGFW MODE, they are compliant when it is Profile-based.
Scoring: Binary: 100 if Profile-based, 0 otherwise.
Implementation score: 100%
Title: Firewall policy configuration check
Description: Any-any accept policies reduce visibility and increase risk. Use least privilege: explicit sources, destinations, services, and logging.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when there are no any any rules for interfaces or all all rules for addresses.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules dont have any -> any or all -> all.
Implementation score: 100%
Title: Firewall policy SSL-SSH configuration check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspection.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection correctly configured.
Implementation score: 100%
Title: Firewall policy AV-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an AV-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and AV-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policy WEB-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for WEB profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an WEB-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and WEB-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policy DNS-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for DNS profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an DNS-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and DNS-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policy IPS-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for IPS profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an IPS-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and IPS-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policy APP-list-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an APP-list-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and APP-list-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policy File-filter-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an File-filter-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and File-filter-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policy event logging
Description: Log of traffic across the network to see events happen.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have logging turned on.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and File-filter-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policies should use flow-based inspection
Description: Flow-based inspection provides better performance and modern security profile integration compared to the legacy proxy-based inspection mode. When available, policies should use flow-based inspection.
Technical implementation: Scope: Firewall policy inspection-mode configuration in VDOMs. Compliant when policies specify inspection-mode as 'flow'. Note: This field may not exist in newer FortiOS versions (7.6.0+).
Scoring: Score = compliant / total * 100. Returns 100 if all policies use flow-based inspection or field doesn't exist. Returns 0 if any policy uses proxy mode.
Implementation score: 100%
Title: Firewall policies should use zones instead of individual interfaces
Description: Organizing interfaces into zones simplifies firewall policy management and makes maintenance easier when interface configurations change.
Technical implementation: Scope: System zone configuration in VDOMs. Compliant when at least one zone is defined.
Scoring: Binary: 100 if at least 1 zone is configured, 0 if no zones defined.
Implementation score: 0%
Title: Firewall policy enable logging on the implicit deny rule
Description: Implicit deny logging increases visibility into blocked traffic and helps validate policy completeness.
Technical implementation: Scope: Configuring the firewall policy's default deny rule, they are compliant when ipv4 and ipv6 logging are turned on.
Scoring: Score = compliant / total * 100. Returns 100 when both ipv4 and ipv6 logging are correctly configured.
Implementation score: 0%
Title: IPsec should use IKEv2 for Phase 1 negotiations
Description: IKEv2 provides better security, faster negotiation, and improved stability compared to IKEv1. All IPsec Phase 1 interfaces should be configured to use IKEv2.
Technical implementation: Scope: IPsec Phase 1 interface configuration (vpn_ipsec_phase1-interface). Compliant when ike-version is set to 2 for all interfaces.
Scoring: Percentage: Score = (compliant Phase 1 interfaces / total Phase 1 interfaces) * 100. 100 if all Phase 1 interfaces use IKEv2, scales down for mixed deployments.
Implementation score: 100%
Title: IPsec should use secure encryption and authentication algorithms
Description: IPsec proposals should not use weak cryptographic algorithms. Weak algorithms include: DES, 3DES, AES128, MD5, SHA1, and DH1-DH5. Use AES256 or stronger for encryption, SHA256 or stronger for authentication.
Technical implementation: Scope: IPsec Phase 1 and Phase 2 proposals (vpn_ipsec_phase1-interface and vpn_ipsec_phase2-interface). A tunnel is compliant when BOTH its Phase 1 and all linked Phase 2 interfaces have no weak algorithms.
Scoring: Percentage: Score = (compliant tunnels / total tunnels) * 100. 100 if all tunnels use strong ciphers/hashes, scales down for mixed compliance.
Implementation score: 100%
Title: SD-WAN should not use default zone
Description: Do not use the default SD-WAN zone (virtual-wan-link). Split into UNDERLAY and OVERLAY zones. Using explicit zones makes intent clear (transport vs tunnels) and keeps routing and policies consistent across sites. UNDERLAY typically contains Internet/MPLS links; OVERLAY contains IPsec tunnels.
Technical implementation: Scope: SD-WAN configuration (system sdwan) and zones. Compliant when SD-WAN is disabled OR when SD-WAN is enabled but the default 'virtual-wan-link' zone is not used.
Scoring: Binary: 100 if SD-WAN is disabled OR default zone is not used, 0 if SD-WAN is enabled with default zone.
Implementation score: 0%
Title: SD-WAN should have at least 2 zones when enabled
Description: When SD-WAN is enabled, there should be at least 2 zones to support proper separation between underlay transport and overlay tunnels.
Technical implementation: Scope: SD-WAN configuration (system sdwan) and zones. Compliant when SD-WAN is disabled OR when SD-WAN is enabled with at least 2 zones configured.
Scoring: Binary: 100 if SD-WAN is disabled OR has at least 2 zones, 0 if SD-WAN is enabled with fewer than 2 zones.
Implementation score: 0%
Title: DoS policy should be configured on WAN/virtual-wan-link interfaces
Description: Denial-of-Service protection policies should be configured on external-facing interfaces (WAN or virtual-wan-link) to detect and mitigate various DoS attacks. If no DoS policies are configured, the device is considered non-compliant.
Technical implementation: Scope: DoS policy configuration (firewall_dos-policy). Compliant when at least one DoS policy is configured with interface set to 'WAN' or 'virtual-wan-link'.
Scoring: Binary: 100 if DoS policy exists on WAN/virtual-wan-link, 0 otherwise.
Implementation score: 0%
Title: DoS policy baseline anomalies should be enabled
Description: The baseline DoS anomalies (TCP SYN flood, UDP flood, ICMP flood) should be enabled in DoS policies to provide core protection against volumetric attacks. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly configurations. Compliant when tcp_syn_flood, udp_flood, and icmp_flood anomalies are enabled in policies on external interfaces.
Scoring: Percentage: (enabled_anomalies / 3) * 100 where 3 is the count of baseline anomalies (tcp_syn, udp, icmp).
Implementation score: 0%
Title: DoS policy baseline thresholds should be customized (non-default)
Description: Each baseline DoS anomaly should have a custom threshold value (not factory default) configured to establish the rate at which the anomaly detection is triggered based on organization-specific needs. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly thresholds. Compliant when tcp_syn_flood, udp_flood, and icmp_flood have CUSTOM thresholds (not defaults: 2000, 2000, 250 respectively).
Scoring: Percentage: (custom_thresholds / 3) * 100 where threshold is not the factory default value.
Implementation score: 0%
Title: DoS policy baseline actions should have blocking and logging enabled
Description: Each baseline DoS anomaly should have its action set to 'block' and logging enabled to ensure threats are blocked and recorded. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly actions. Compliant when tcp_syn_flood, udp_flood, and icmp_flood have action='block' AND log=true.
Scoring: Percentage: (compliant_actions / 3) * 100 where an anomaly is compliant if action='block' and log=true.
Implementation score: 0%
Title: NGFW-mode configuration check
Description: Profile-based mode standardizes UTM configuration and aligns with most operational models using security profiles on policies.
Technical implementation: Scope: Configuring the NGFW MODE, they are compliant when it is Profile-based.
Scoring: Binary: 100 if Profile-based, 0 otherwise.
Implementation score: 100%
Title: Firewall policy configuration check
Description: Any-any accept policies reduce visibility and increase risk. Use least privilege: explicit sources, destinations, services, and logging.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when there are no any any rules for interfaces or all all rules for addresses.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules dont have any -> any or all -> all.
Implementation score: 100%
Title: Firewall policy SSL-SSH configuration check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspection.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection correctly configured.
Implementation score: 100%
Title: Firewall policy AV-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an AV-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and AV-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policy WEB-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for WEB profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an WEB-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and WEB-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policy DNS-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for DNS profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an DNS-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and DNS-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policy IPS-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for IPS profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an IPS-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and IPS-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policy APP-list-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an APP-list-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and APP-list-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policy File-filter-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an File-filter-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and File-filter-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policy event logging
Description: Log of traffic across the network to see events happen.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have logging turned on.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and File-filter-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policies should use flow-based inspection
Description: Flow-based inspection provides better performance and modern security profile integration compared to the legacy proxy-based inspection mode. When available, policies should use flow-based inspection.
Technical implementation: Scope: Firewall policy inspection-mode configuration in VDOMs. Compliant when policies specify inspection-mode as 'flow'. Note: This field may not exist in newer FortiOS versions (7.6.0+).
Scoring: Score = compliant / total * 100. Returns 100 if all policies use flow-based inspection or field doesn't exist. Returns 0 if any policy uses proxy mode.
Implementation score: 100%
Title: Firewall policies should use zones instead of individual interfaces
Description: Organizing interfaces into zones simplifies firewall policy management and makes maintenance easier when interface configurations change.
Technical implementation: Scope: System zone configuration in VDOMs. Compliant when at least one zone is defined.
Scoring: Binary: 100 if at least 1 zone is configured, 0 if no zones defined.
Implementation score: 0%
Title: Firewall policy enable logging on the implicit deny rule
Description: Implicit deny logging increases visibility into blocked traffic and helps validate policy completeness.
Technical implementation: Scope: Configuring the firewall policy's default deny rule, they are compliant when ipv4 and ipv6 logging are turned on.
Scoring: Score = compliant / total * 100. Returns 100 when both ipv4 and ipv6 logging are correctly configured.
Implementation score: 0%
Title: IPsec should use IKEv2 for Phase 1 negotiations
Description: IKEv2 provides better security, faster negotiation, and improved stability compared to IKEv1. All IPsec Phase 1 interfaces should be configured to use IKEv2.
Technical implementation: Scope: IPsec Phase 1 interface configuration (vpn_ipsec_phase1-interface). Compliant when ike-version is set to 2 for all interfaces.
Scoring: Percentage: Score = (compliant Phase 1 interfaces / total Phase 1 interfaces) * 100. 100 if all Phase 1 interfaces use IKEv2, scales down for mixed deployments.
Implementation score: 100%
Title: IPsec should use secure encryption and authentication algorithms
Description: IPsec proposals should not use weak cryptographic algorithms. Weak algorithms include: DES, 3DES, AES128, MD5, SHA1, and DH1-DH5. Use AES256 or stronger for encryption, SHA256 or stronger for authentication.
Technical implementation: Scope: IPsec Phase 1 and Phase 2 proposals (vpn_ipsec_phase1-interface and vpn_ipsec_phase2-interface). A tunnel is compliant when BOTH its Phase 1 and all linked Phase 2 interfaces have no weak algorithms.
Scoring: Percentage: Score = (compliant tunnels / total tunnels) * 100. 100 if all tunnels use strong ciphers/hashes, scales down for mixed compliance.
Implementation score: 100%
Title: SD-WAN should not use default zone
Description: Do not use the default SD-WAN zone (virtual-wan-link). Split into UNDERLAY and OVERLAY zones. Using explicit zones makes intent clear (transport vs tunnels) and keeps routing and policies consistent across sites. UNDERLAY typically contains Internet/MPLS links; OVERLAY contains IPsec tunnels.
Technical implementation: Scope: SD-WAN configuration (system sdwan) and zones. Compliant when SD-WAN is disabled OR when SD-WAN is enabled but the default 'virtual-wan-link' zone is not used.
Scoring: Binary: 100 if SD-WAN is disabled OR default zone is not used, 0 if SD-WAN is enabled with default zone.
Implementation score: 0%
Title: SD-WAN should have at least 2 zones when enabled
Description: When SD-WAN is enabled, there should be at least 2 zones to support proper separation between underlay transport and overlay tunnels.
Technical implementation: Scope: SD-WAN configuration (system sdwan) and zones. Compliant when SD-WAN is disabled OR when SD-WAN is enabled with at least 2 zones configured.
Scoring: Binary: 100 if SD-WAN is disabled OR has at least 2 zones, 0 if SD-WAN is enabled with fewer than 2 zones.
Implementation score: 0%
Title: DoS policy should be configured on WAN/virtual-wan-link interfaces
Description: Denial-of-Service protection policies should be configured on external-facing interfaces (WAN or virtual-wan-link) to detect and mitigate various DoS attacks. If no DoS policies are configured, the device is considered non-compliant.
Technical implementation: Scope: DoS policy configuration (firewall_dos-policy). Compliant when at least one DoS policy is configured with interface set to 'WAN' or 'virtual-wan-link'.
Scoring: Binary: 100 if DoS policy exists on WAN/virtual-wan-link, 0 otherwise.
Implementation score: 0%
Title: DoS policy baseline anomalies should be enabled
Description: The baseline DoS anomalies (TCP SYN flood, UDP flood, ICMP flood) should be enabled in DoS policies to provide core protection against volumetric attacks. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly configurations. Compliant when tcp_syn_flood, udp_flood, and icmp_flood anomalies are enabled in policies on external interfaces.
Scoring: Percentage: (enabled_anomalies / 3) * 100 where 3 is the count of baseline anomalies (tcp_syn, udp, icmp).
Implementation score: 0%
Title: DoS policy baseline thresholds should be customized (non-default)
Description: Each baseline DoS anomaly should have a custom threshold value (not factory default) configured to establish the rate at which the anomaly detection is triggered based on organization-specific needs. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly thresholds. Compliant when tcp_syn_flood, udp_flood, and icmp_flood have CUSTOM thresholds (not defaults: 2000, 2000, 250 respectively).
Scoring: Percentage: (custom_thresholds / 3) * 100 where threshold is not the factory default value.
Implementation score: 0%
Title: DoS policy baseline actions should have blocking and logging enabled
Description: Each baseline DoS anomaly should have its action set to 'block' and logging enabled to ensure threats are blocked and recorded. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly actions. Compliant when tcp_syn_flood, udp_flood, and icmp_flood have action='block' AND log=true.
Scoring: Percentage: (compliant_actions / 3) * 100 where an anomaly is compliant if action='block' and log=true.
Implementation score: 0%
Title: NGFW-mode configuration check
Description: Profile-based mode standardizes UTM configuration and aligns with most operational models using security profiles on policies.
Technical implementation: Scope: Configuring the NGFW MODE, they are compliant when it is Profile-based.
Scoring: Binary: 100 if Profile-based, 0 otherwise.
Implementation score: 100%
Title: Firewall policy configuration check
Description: Any-any accept policies reduce visibility and increase risk. Use least privilege: explicit sources, destinations, services, and logging.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when there are no any any rules for interfaces or all all rules for addresses.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules dont have any -> any or all -> all.
Implementation score: 100%
Title: Firewall policy SSL-SSH configuration check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspection.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection correctly configured.
Implementation score: 0%
Title: Firewall policy AV-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an AV-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and AV-profile inspection correctly configured.
Implementation score: 0%
Title: Firewall policy WEB-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for WEB profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an WEB-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and WEB-profile inspection correctly configured.
Implementation score: 0%
Title: Firewall policy DNS-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for DNS profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an DNS-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and DNS-profile inspection correctly configured.
Implementation score: 0%
Title: Firewall policy IPS-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for IPS profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an IPS-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and IPS-profile inspection correctly configured.
Implementation score: 0%
Title: Firewall policy APP-list-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an APP-list-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and APP-list-profile inspection correctly configured.
Implementation score: 0%
Title: Firewall policy File-filter-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an File-filter-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and File-filter-profile inspection correctly configured.
Implementation score: 0%
Title: Firewall policy event logging
Description: Log of traffic across the network to see events happen.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have logging turned on.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and File-filter-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policies should use flow-based inspection
Description: Flow-based inspection provides better performance and modern security profile integration compared to the legacy proxy-based inspection mode. When available, policies should use flow-based inspection.
Technical implementation: Scope: Firewall policy inspection-mode configuration in VDOMs. Compliant when policies specify inspection-mode as 'flow'. Note: This field may not exist in newer FortiOS versions (7.6.0+).
Scoring: Score = compliant / total * 100. Returns 100 if all policies use flow-based inspection or field doesn't exist. Returns 0 if any policy uses proxy mode.
Implementation score: 100%
Title: Firewall policies should use zones instead of individual interfaces
Description: Organizing interfaces into zones simplifies firewall policy management and makes maintenance easier when interface configurations change.
Technical implementation: Scope: System zone configuration in VDOMs. Compliant when at least one zone is defined.
Scoring: Binary: 100 if at least 1 zone is configured, 0 if no zones defined.
Implementation score: 0%
Title: Firewall policy enable logging on the implicit deny rule
Description: Implicit deny logging increases visibility into blocked traffic and helps validate policy completeness.
Technical implementation: Scope: Configuring the firewall policy's default deny rule, they are compliant when ipv4 and ipv6 logging are turned on.
Scoring: Score = compliant / total * 100. Returns 100 when both ipv4 and ipv6 logging are correctly configured.
Implementation score: 0%
Title: IPsec should use IKEv2 for Phase 1 negotiations
Description: IKEv2 provides better security, faster negotiation, and improved stability compared to IKEv1. All IPsec Phase 1 interfaces should be configured to use IKEv2.
Technical implementation: Scope: IPsec Phase 1 interface configuration (vpn_ipsec_phase1-interface). Compliant when ike-version is set to 2 for all interfaces.
Scoring: Percentage: Score = (compliant Phase 1 interfaces / total Phase 1 interfaces) * 100. 100 if all Phase 1 interfaces use IKEv2, scales down for mixed deployments.
Implementation score: 100%
Title: IPsec should use secure encryption and authentication algorithms
Description: IPsec proposals should not use weak cryptographic algorithms. Weak algorithms include: DES, 3DES, AES128, MD5, SHA1, and DH1-DH5. Use AES256 or stronger for encryption, SHA256 or stronger for authentication.
Technical implementation: Scope: IPsec Phase 1 and Phase 2 proposals (vpn_ipsec_phase1-interface and vpn_ipsec_phase2-interface). A tunnel is compliant when BOTH its Phase 1 and all linked Phase 2 interfaces have no weak algorithms.
Scoring: Percentage: Score = (compliant tunnels / total tunnels) * 100. 100 if all tunnels use strong ciphers/hashes, scales down for mixed compliance.
Implementation score: 100%
Title: SD-WAN should not use default zone
Description: Do not use the default SD-WAN zone (virtual-wan-link). Split into UNDERLAY and OVERLAY zones. Using explicit zones makes intent clear (transport vs tunnels) and keeps routing and policies consistent across sites. UNDERLAY typically contains Internet/MPLS links; OVERLAY contains IPsec tunnels.
Technical implementation: Scope: SD-WAN configuration (system sdwan) and zones. Compliant when SD-WAN is disabled OR when SD-WAN is enabled but the default 'virtual-wan-link' zone is not used.
Scoring: Binary: 100 if SD-WAN is disabled OR default zone is not used, 0 if SD-WAN is enabled with default zone.
Implementation score: 0%
Title: SD-WAN should have at least 2 zones when enabled
Description: When SD-WAN is enabled, there should be at least 2 zones to support proper separation between underlay transport and overlay tunnels.
Technical implementation: Scope: SD-WAN configuration (system sdwan) and zones. Compliant when SD-WAN is disabled OR when SD-WAN is enabled with at least 2 zones configured.
Scoring: Binary: 100 if SD-WAN is disabled OR has at least 2 zones, 0 if SD-WAN is enabled with fewer than 2 zones.
Implementation score: 0%
Title: DoS policy should be configured on WAN/virtual-wan-link interfaces
Description: Denial-of-Service protection policies should be configured on external-facing interfaces (WAN or virtual-wan-link) to detect and mitigate various DoS attacks. If no DoS policies are configured, the device is considered non-compliant.
Technical implementation: Scope: DoS policy configuration (firewall_dos-policy). Compliant when at least one DoS policy is configured with interface set to 'WAN' or 'virtual-wan-link'.
Scoring: Binary: 100 if DoS policy exists on WAN/virtual-wan-link, 0 otherwise.
Implementation score: 0%
Title: DoS policy baseline anomalies should be enabled
Description: The baseline DoS anomalies (TCP SYN flood, UDP flood, ICMP flood) should be enabled in DoS policies to provide core protection against volumetric attacks. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly configurations. Compliant when tcp_syn_flood, udp_flood, and icmp_flood anomalies are enabled in policies on external interfaces.
Scoring: Percentage: (enabled_anomalies / 3) * 100 where 3 is the count of baseline anomalies (tcp_syn, udp, icmp).
Implementation score: 0%
Title: DoS policy baseline thresholds should be customized (non-default)
Description: Each baseline DoS anomaly should have a custom threshold value (not factory default) configured to establish the rate at which the anomaly detection is triggered based on organization-specific needs. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly thresholds. Compliant when tcp_syn_flood, udp_flood, and icmp_flood have CUSTOM thresholds (not defaults: 2000, 2000, 250 respectively).
Scoring: Percentage: (custom_thresholds / 3) * 100 where threshold is not the factory default value.
Implementation score: 0%
Title: DoS policy baseline actions should have blocking and logging enabled
Description: Each baseline DoS anomaly should have its action set to 'block' and logging enabled to ensure threats are blocked and recorded. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly actions. Compliant when tcp_syn_flood, udp_flood, and icmp_flood have action='block' AND log=true.
Scoring: Percentage: (compliant_actions / 3) * 100 where an anomaly is compliant if action='block' and log=true.
Implementation score: 0%
Title: NGFW-mode configuration check
Description: Profile-based mode standardizes UTM configuration and aligns with most operational models using security profiles on policies.
Technical implementation: Scope: Configuring the NGFW MODE, they are compliant when it is Profile-based.
Scoring: Binary: 100 if Profile-based, 0 otherwise.
Implementation score: 100%
Title: Firewall policy configuration check
Description: Any-any accept policies reduce visibility and increase risk. Use least privilege: explicit sources, destinations, services, and logging.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when there are no any any rules for interfaces or all all rules for addresses.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules dont have any -> any or all -> all.
Implementation score: 100%
Title: Firewall policy SSL-SSH configuration check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspection.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection correctly configured.
Implementation score: 75%
Title: Firewall policy AV-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an AV-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and AV-profile inspection correctly configured.
Implementation score: 75%
Title: Firewall policy WEB-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for WEB profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an WEB-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and WEB-profile inspection correctly configured.
Implementation score: 75%
Title: Firewall policy DNS-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for DNS profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an DNS-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and DNS-profile inspection correctly configured.
Implementation score: 75%
Title: Firewall policy IPS-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for IPS profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an IPS-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and IPS-profile inspection correctly configured.
Implementation score: 75%
Title: Firewall policy APP-list-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an APP-list-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and APP-list-profile inspection correctly configured.
Implementation score: 75%
Title: Firewall policy File-filter-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an File-filter-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and File-filter-profile inspection correctly configured.
Implementation score: 75%
Title: Firewall policy event logging
Description: Log of traffic across the network to see events happen.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have logging turned on.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and File-filter-profile inspection correctly configured.
Implementation score: 75%
Title: Firewall policies should use flow-based inspection
Description: Flow-based inspection provides better performance and modern security profile integration compared to the legacy proxy-based inspection mode. When available, policies should use flow-based inspection.
Technical implementation: Scope: Firewall policy inspection-mode configuration in VDOMs. Compliant when policies specify inspection-mode as 'flow'. Note: This field may not exist in newer FortiOS versions (7.6.0+).
Scoring: Score = compliant / total * 100. Returns 100 if all policies use flow-based inspection or field doesn't exist. Returns 0 if any policy uses proxy mode.
Implementation score: 100%
Title: Firewall policies should use zones instead of individual interfaces
Description: Organizing interfaces into zones simplifies firewall policy management and makes maintenance easier when interface configurations change.
Technical implementation: Scope: System zone configuration in VDOMs. Compliant when at least one zone is defined.
Scoring: Binary: 100 if at least 1 zone is configured, 0 if no zones defined.
Implementation score: 0%
Title: Firewall policy enable logging on the implicit deny rule
Description: Implicit deny logging increases visibility into blocked traffic and helps validate policy completeness.
Technical implementation: Scope: Configuring the firewall policy's default deny rule, they are compliant when ipv4 and ipv6 logging are turned on.
Scoring: Score = compliant / total * 100. Returns 100 when both ipv4 and ipv6 logging are correctly configured.
Implementation score: 0%
Title: IPsec should use IKEv2 for Phase 1 negotiations
Description: IKEv2 provides better security, faster negotiation, and improved stability compared to IKEv1. All IPsec Phase 1 interfaces should be configured to use IKEv2.
Technical implementation: Scope: IPsec Phase 1 interface configuration (vpn_ipsec_phase1-interface). Compliant when ike-version is set to 2 for all interfaces.
Scoring: Percentage: Score = (compliant Phase 1 interfaces / total Phase 1 interfaces) * 100. 100 if all Phase 1 interfaces use IKEv2, scales down for mixed deployments.
Implementation score: 100%
Title: IPsec should use secure encryption and authentication algorithms
Description: IPsec proposals should not use weak cryptographic algorithms. Weak algorithms include: DES, 3DES, AES128, MD5, SHA1, and DH1-DH5. Use AES256 or stronger for encryption, SHA256 or stronger for authentication.
Technical implementation: Scope: IPsec Phase 1 and Phase 2 proposals (vpn_ipsec_phase1-interface and vpn_ipsec_phase2-interface). A tunnel is compliant when BOTH its Phase 1 and all linked Phase 2 interfaces have no weak algorithms.
Scoring: Percentage: Score = (compliant tunnels / total tunnels) * 100. 100 if all tunnels use strong ciphers/hashes, scales down for mixed compliance.
Implementation score: 100%
Title: SD-WAN should not use default zone
Description: Do not use the default SD-WAN zone (virtual-wan-link). Split into UNDERLAY and OVERLAY zones. Using explicit zones makes intent clear (transport vs tunnels) and keeps routing and policies consistent across sites. UNDERLAY typically contains Internet/MPLS links; OVERLAY contains IPsec tunnels.
Technical implementation: Scope: SD-WAN configuration (system sdwan) and zones. Compliant when SD-WAN is disabled OR when SD-WAN is enabled but the default 'virtual-wan-link' zone is not used.
Scoring: Binary: 100 if SD-WAN is disabled OR default zone is not used, 0 if SD-WAN is enabled with default zone.
Implementation score: 0%
Title: SD-WAN should have at least 2 zones when enabled
Description: When SD-WAN is enabled, there should be at least 2 zones to support proper separation between underlay transport and overlay tunnels.
Technical implementation: Scope: SD-WAN configuration (system sdwan) and zones. Compliant when SD-WAN is disabled OR when SD-WAN is enabled with at least 2 zones configured.
Scoring: Binary: 100 if SD-WAN is disabled OR has at least 2 zones, 0 if SD-WAN is enabled with fewer than 2 zones.
Implementation score: 100%
Title: DoS policy should be configured on WAN/virtual-wan-link interfaces
Description: Denial-of-Service protection policies should be configured on external-facing interfaces (WAN or virtual-wan-link) to detect and mitigate various DoS attacks. If no DoS policies are configured, the device is considered non-compliant.
Technical implementation: Scope: DoS policy configuration (firewall_dos-policy). Compliant when at least one DoS policy is configured with interface set to 'WAN' or 'virtual-wan-link'.
Scoring: Binary: 100 if DoS policy exists on WAN/virtual-wan-link, 0 otherwise.
Implementation score: 0%
Title: DoS policy baseline anomalies should be enabled
Description: The baseline DoS anomalies (TCP SYN flood, UDP flood, ICMP flood) should be enabled in DoS policies to provide core protection against volumetric attacks. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly configurations. Compliant when tcp_syn_flood, udp_flood, and icmp_flood anomalies are enabled in policies on external interfaces.
Scoring: Percentage: (enabled_anomalies / 3) * 100 where 3 is the count of baseline anomalies (tcp_syn, udp, icmp).
Implementation score: 100%
Title: DoS policy baseline thresholds should be customized (non-default)
Description: Each baseline DoS anomaly should have a custom threshold value (not factory default) configured to establish the rate at which the anomaly detection is triggered based on organization-specific needs. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly thresholds. Compliant when tcp_syn_flood, udp_flood, and icmp_flood have CUSTOM thresholds (not defaults: 2000, 2000, 250 respectively).
Scoring: Percentage: (custom_thresholds / 3) * 100 where threshold is not the factory default value.
Implementation score: 50%
Title: DoS policy baseline actions should have blocking and logging enabled
Description: Each baseline DoS anomaly should have its action set to 'block' and logging enabled to ensure threats are blocked and recorded. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly actions. Compliant when tcp_syn_flood, udp_flood, and icmp_flood have action='block' AND log=true.
Scoring: Percentage: (compliant_actions / 3) * 100 where an anomaly is compliant if action='block' and log=true.
Implementation score: 100%
Title: NGFW-mode configuration check
Description: Profile-based mode standardizes UTM configuration and aligns with most operational models using security profiles on policies.
Technical implementation: Scope: Configuring the NGFW MODE, they are compliant when it is Profile-based.
Scoring: Binary: 100 if Profile-based, 0 otherwise.
Implementation score: 0%
Title: Firewall policy configuration check
Description: Any-any accept policies reduce visibility and increase risk. Use least privilege: explicit sources, destinations, services, and logging.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when there are no any any rules for interfaces or all all rules for addresses.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules dont have any -> any or all -> all.
Implementation score: 100%
Title: Firewall policy SSL-SSH configuration check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspection.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection correctly configured.
Implementation score: 50%
Title: Firewall policy AV-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an AV-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and AV-profile inspection correctly configured.
Implementation score: 50%
Title: Firewall policy WEB-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for WEB profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an WEB-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and WEB-profile inspection correctly configured.
Implementation score: 50%
Title: Firewall policy DNS-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for DNS profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an DNS-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and DNS-profile inspection correctly configured.
Implementation score: 50%
Title: Firewall policy IPS-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for IPS profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an IPS-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and IPS-profile inspection correctly configured.
Implementation score: 50%
Title: Firewall policy APP-list-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an APP-list-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and APP-list-profile inspection correctly configured.
Implementation score: 50%
Title: Firewall policy File-filter-profile inspection check
Description: Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an File-filter-profile inspection security profile.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and File-filter-profile inspection correctly configured.
Implementation score: 50%
Title: Firewall policy event logging
Description: Log of traffic across the network to see events happen.
Technical implementation: Scope: Configuring the firewall policy's, they are compliant when all active rules have logging turned on.
Scoring: Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and File-filter-profile inspection correctly configured.
Implementation score: 100%
Title: Firewall policies should use flow-based inspection
Description: Flow-based inspection provides better performance and modern security profile integration compared to the legacy proxy-based inspection mode. When available, policies should use flow-based inspection.
Technical implementation: Scope: Firewall policy inspection-mode configuration in VDOMs. Compliant when policies specify inspection-mode as 'flow'. Note: This field may not exist in newer FortiOS versions (7.6.0+).
Scoring: Score = compliant / total * 100. Returns 100 if all policies use flow-based inspection or field doesn't exist. Returns 0 if any policy uses proxy mode.
Implementation score: 100%
Title: Firewall policies should use zones instead of individual interfaces
Description: Organizing interfaces into zones simplifies firewall policy management and makes maintenance easier when interface configurations change.
Technical implementation: Scope: System zone configuration in VDOMs. Compliant when at least one zone is defined.
Scoring: Binary: 100 if at least 1 zone is configured, 0 if no zones defined.
Implementation score: 0%
Title: Firewall policy enable logging on the implicit deny rule
Description: Implicit deny logging increases visibility into blocked traffic and helps validate policy completeness.
Technical implementation: Scope: Configuring the firewall policy's default deny rule, they are compliant when ipv4 and ipv6 logging are turned on.
Scoring: Score = compliant / total * 100. Returns 100 when both ipv4 and ipv6 logging are correctly configured.
Implementation score: 0%
Title: IPsec should use IKEv2 for Phase 1 negotiations
Description: IKEv2 provides better security, faster negotiation, and improved stability compared to IKEv1. All IPsec Phase 1 interfaces should be configured to use IKEv2.
Technical implementation: Scope: IPsec Phase 1 interface configuration (vpn_ipsec_phase1-interface). Compliant when ike-version is set to 2 for all interfaces.
Scoring: Percentage: Score = (compliant Phase 1 interfaces / total Phase 1 interfaces) * 100. 100 if all Phase 1 interfaces use IKEv2, scales down for mixed deployments.
Implementation score: 0%
Title: IPsec should use secure encryption and authentication algorithms
Description: IPsec proposals should not use weak cryptographic algorithms. Weak algorithms include: DES, 3DES, AES128, MD5, SHA1, and DH1-DH5. Use AES256 or stronger for encryption, SHA256 or stronger for authentication.
Technical implementation: Scope: IPsec Phase 1 and Phase 2 proposals (vpn_ipsec_phase1-interface and vpn_ipsec_phase2-interface). A tunnel is compliant when BOTH its Phase 1 and all linked Phase 2 interfaces have no weak algorithms.
Scoring: Percentage: Score = (compliant tunnels / total tunnels) * 100. 100 if all tunnels use strong ciphers/hashes, scales down for mixed compliance.
Implementation score: 100%
Title: SD-WAN should not use default zone
Description: Do not use the default SD-WAN zone (virtual-wan-link). Split into UNDERLAY and OVERLAY zones. Using explicit zones makes intent clear (transport vs tunnels) and keeps routing and policies consistent across sites. UNDERLAY typically contains Internet/MPLS links; OVERLAY contains IPsec tunnels.
Technical implementation: Scope: SD-WAN configuration (system sdwan) and zones. Compliant when SD-WAN is disabled OR when SD-WAN is enabled but the default 'virtual-wan-link' zone is not used.
Scoring: Binary: 100 if SD-WAN is disabled OR default zone is not used, 0 if SD-WAN is enabled with default zone.
Implementation score: 0%
Title: SD-WAN should have at least 2 zones when enabled
Description: When SD-WAN is enabled, there should be at least 2 zones to support proper separation between underlay transport and overlay tunnels.
Technical implementation: Scope: SD-WAN configuration (system sdwan) and zones. Compliant when SD-WAN is disabled OR when SD-WAN is enabled with at least 2 zones configured.
Scoring: Binary: 100 if SD-WAN is disabled OR has at least 2 zones, 0 if SD-WAN is enabled with fewer than 2 zones.
Implementation score: 0%
Title: DoS policy should be configured on WAN/virtual-wan-link interfaces
Description: Denial-of-Service protection policies should be configured on external-facing interfaces (WAN or virtual-wan-link) to detect and mitigate various DoS attacks. If no DoS policies are configured, the device is considered non-compliant.
Technical implementation: Scope: DoS policy configuration (firewall_dos-policy). Compliant when at least one DoS policy is configured with interface set to 'WAN' or 'virtual-wan-link'.
Scoring: Binary: 100 if DoS policy exists on WAN/virtual-wan-link, 0 otherwise.
Implementation score: 0%
Title: DoS policy baseline anomalies should be enabled
Description: The baseline DoS anomalies (TCP SYN flood, UDP flood, ICMP flood) should be enabled in DoS policies to provide core protection against volumetric attacks. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly configurations. Compliant when tcp_syn_flood, udp_flood, and icmp_flood anomalies are enabled in policies on external interfaces.
Scoring: Percentage: (enabled_anomalies / 3) * 100 where 3 is the count of baseline anomalies (tcp_syn, udp, icmp).
Implementation score: 0%
Title: DoS policy baseline thresholds should be customized (non-default)
Description: Each baseline DoS anomaly should have a custom threshold value (not factory default) configured to establish the rate at which the anomaly detection is triggered based on organization-specific needs. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly thresholds. Compliant when tcp_syn_flood, udp_flood, and icmp_flood have CUSTOM thresholds (not defaults: 2000, 2000, 250 respectively).
Scoring: Percentage: (custom_thresholds / 3) * 100 where threshold is not the factory default value.
Implementation score: 0%
Title: DoS policy baseline actions should have blocking and logging enabled
Description: Each baseline DoS anomaly should have its action set to 'block' and logging enabled to ensure threats are blocked and recorded. If no DoS policies are configured, the check returns 0% compliance.
Technical implementation: Scope: DoS policy anomaly actions. Compliant when tcp_syn_flood, udp_flood, and icmp_flood have action='block' AND log=true.
Scoring: Percentage: (compliant_actions / 3) * 100 where an anomaly is compliant if action='block' and log=true.
Implementation score: 0%

Input (pre-seed)

Vendors

Vendor.name
FORTINET_FIREWALL

Best Practices

BestPractice.name BestPractice.title BestPractice.description BestPractice.technical_implementation BestPractice.scoring_implementation BestPractice.category BestPractice.vendor
BP_FORTIFW_BOOL_TIME_ZONE Time Zone should be UTC 0 Accurate time is required for troubleshooting, certificate validation, and log correlation. Set the device time zone to UTC 0. Scope: The timezone configuration. Binary: 100 if Timezone is UTC 0 or 80 in Fortinet, 0 otherwise. Device configuration FORTINET_FIREWALL
BP_FORTIFW_BOOL_NTP_CONFIG NTP server should be configured For correctly logged time stamps in your logs you need to use 2 NTP servers. A primary to set the time and a secondary to make sure they match. Fortinet also has a fortigaurd ntp configuration setting wich is a group of ntp servers. Scope: The NTP server configuration. Binary: 100 if NTP server uses Fortigaurd as NTP server or if NTP server is custom with 2 servers configures, 0 otherwise. Device configuration FORTINET_FIREWALL
BP_FORTIFW_BOOL_ADMIN_LOCKOUT_POLICY Admin login policy should be configured To prevent bruteforcing of an admin account limit the login attempts and when these get exceeded give a time-out for that user. Scope: Configuring the admin login lockout policy. Compliant when admin-lockout-threshold is >= 3 AND admin-lockout-duration is >= 300 seconds (5 minutes). Note: if not explicitly configured, defaults are assumed. Score = compliant / total * 100. Returns 100 if login failed attempts and the lockout time is correctly configured. Admin user configuration FORTINET_FIREWALL
BP_FORTIFW_BOOL_ADMIN_DEFAULT_DISABLED Admin default user should be disabled For security reasons it is best to rename the default admin account. Scope: users accounts that are configured. They are compliant when the default admin user is renamed or deleted Binary: 100 if default admin is removed, 0 otherwise. Admin user configuration FORTINET_FIREWALL
BP_FORTIFW_BOOL_ADMIN_BACKUPS Second admin user should be configured For safety it is best to configure a second admin account that just exists in case you accidently lock out the main admin. Scope: users accounts that are configured. They are compliant when there are 2 super admins. Binary: 100 if 2 super admins are configured, 0 otherwise. Admin user configuration FORTINET_FIREWALL
BP_FORTIFW_BOOL_HTTPS_ADMIN_PORTS Admin HTTPS port configuration should be secure Configure secure HTTPS settings for admin access by using non-default port, HTTPS redirect disabled, strong crypto enabled, and TLS 1.2+. Scope: Admin HTTPS configuration. Compliant when admin-sport is NOT the default 443, admin-https-redirect is disabled, strong-crypto is enabled, and admin-https-ssl-versions contains only tlsv1-2 and tlsv1-3. Binary: 100 if all HTTPS settings are correct, 0 otherwise. Admin access configuration FORTINET_FIREWALL
BP_FORTIFW_BOOL_SSH_ADMIN_PORTS Admin SSH port configuration should be secure Configure secure SSH settings for admin access by using non-default port and disabling SSHv1. Scope: Admin SSH configuration. Compliant when admin-ssh-port is NOT the default 22 and admin-ssh-v1 is disabled. Binary: 100 if all SSH settings are correct, 0 otherwise. Admin access configuration FORTINET_FIREWALL
BP_FORTIFW_BOOL_AUTO_FIRMWARE_UPGRADE Automatic firmware update should be disabled To prevent unwanted downtimes or device restart disable the automatic update of the device. Scope: Configuring the automatic firmware upgrade setting. They are compliant when auto-firmware-upgrade is disabled. Score = compliant / total * 100. Returns 100 if login failed attempts and the lockout time is correctly configured. Device configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_PASSWORD_POLICY Admin password policy should be configured To make unwanted acces harder configuring minimum password requirements is needed. Scope: Configuring the admin password policy, they are compliant when it is enabled with a minimum length of 15, require at least 1 lowercase letter, uppercase letter, special character, number and have reusing old password disabled. Score = compliant / total * 100. Returns 100 if password policy is correctly configured. Admin user configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_ADMIN_TWO_FACTOR Admin 2Factor login should be configured To make unwanted acces harder enabling admin 2fa is needed. Scope: Configuring the admin 2fa authentication, they are compliant when it is enabled. Score = compliant / total * 100. Returns 100 if all admins have 2fa configured. Admin user configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_ADMIN_RESTRICTED_LOGIN Admin login restriction should be configured To make unwanted acces harder configuring login location restrictions is needed. Scope: Configuring the admin login restriction authentication, they are compliant when it is enabled. Score = compliant / total * 100. Returns 100 if all admins have login restrictions configured. Admin user configuration FORTINET_FIREWALL
BP_FORTIFW_BOOL_ADMIN_SERVER_CERTIFICATE Admin server certificate should not be default To make unwanted acces harder configuring login location restrictions is needed. Replace the default admin server certificate with an organization-specific certificate to prevent man-in-the-middle attacks. Scope: Configuring the admin login restriction authentication, they are compliant when it is enabled. Score = compliant / total * 100. Returns 100 if all admins have login restrictions configured. Admin user configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_SNMP_CONFIGURATION SNMP configuration check To make unwanted acces harder configuring login location restrictions is needed. Scope: Configuring the SNMP, they are compliant when it is disabled, or when it only v3 is enabled. Score = compliant / total * 100. Returns 100 if disabled or all SNMPv3 are configured with hosts and a require a password. Management configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_IPS_GLOBAL_CONFIGURATION Global IPS configuration check With the OT Security Services license, OT-related IPS signatures can be used for detection. GUI visibility is optional; signatures should not be excluded. Scope: Configuring the Global IPS settings to exclude not signatures, they are compliant when it is none. Binary: 100 if exclude signatures is none, 0 otherwise. Management configuration FORTINET_FIREWALL
BP_FORTIFW_BOOL_SSL_VPN_DISABLED SSL-VPN should be disabled SSL-VPN should be disabled unless explicitly required for remote access. Enabling SSL-VPN without proper security controls increases the attack surface. Scope: Checking the SSL-VPN status, they are compliant when it is disabled. Binary: 100 if SSL-VPN is disabled, 0 if enabled. Remote Access Configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_HA_MODE_CONFIGURATION High availibility mode configuration check Active-passive is the most common and predictable HA mode for branch and perimeter deployments. It simplifies troubleshooting and avoids asymmetric traffic concerns. Scope: Configuring the High Availability mode. Compliant when mode = 'a-p' (active-passive). Note: Check uses literal token match; ensure device outputs 'a-p' not 'active-passive'. Binary: 100 if Active-passive, 0 otherwise. Management configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_HA_HEARTBEAT_DEVICE_CONFIGURATION High availibility mode configuration check Two heartbeat links provide redundancy and reduce the likelihood of split-brain or failover instability due to a single cable/switch failure. Scope: Configuring the High availibility Heartbeat devices, they are compliant when there are 2. Binary: 100 if Active-passive, 0 otherwise. Management configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_HA_MONITOR_CONFIGURATION High availibility mode configuration check Monitoring should reflect real service health (core reachability). Avoid triggering failover due to WAN jitter or heartbeat-specific paths. Scope: Configuring the High availibility monitor interfaces, they are compliant when they are not the Heartbeat devices or wan interfaces. Binary: 100 if Active-passive, 0 otherwise. Management configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_HA_SESSION_PICKUP_CONFIGURATION High availibility mode configuration check Session pickup reduces disruption during failover by synchronizing sessions between cluster members. Scope: Configuring the High availibility session pickup, they are compliant when it is turned on. Binary: 100 if turned on, 0 otherwise. Management configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_VDOM_NGFW_MODE NGFW-mode configuration check Profile-based mode standardizes UTM configuration and aligns with most operational models using security profiles on policies. Scope: Configuring the NGFW MODE, they are compliant when it is Profile-based. Binary: 100 if Profile-based, 0 otherwise. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_VDOM_ANY_ANY_RULES Firewall policy configuration check Any-any accept policies reduce visibility and increase risk. Use least privilege: explicit sources, destinations, services, and logging. Scope: Configuring the firewall policy's, they are compliant when there are no any any rules for interfaces or all all rules for addresses. Score = compliant / total * 100. Returns 100 if disabled or all rules dont have any -> any or all -> all. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION Firewall policy SSL-SSH configuration check Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspection. Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection correctly configured. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION Firewall policy AV-profile inspection check Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles. Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an AV-profile inspection security profile. Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and AV-profile inspection correctly configured. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION Firewall policy WEB-profile inspection check Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for WEB profiles. Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an WEB-profile inspection security profile. Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and WEB-profile inspection correctly configured. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION Firewall policy DNS-profile inspection check Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for DNS profiles. Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an DNS-profile inspection security profile. Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and DNS-profile inspection correctly configured. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION Firewall policy IPS-profile inspection check Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for IPS profiles. Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an IPS-profile inspection security profile. Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and IPS-profile inspection correctly configured. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION Firewall policy APP-list-profile inspection check Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles. Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an APP-list-profile inspection security profile. Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and APP-list-profile inspection correctly configured. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION Firewall policy File-filter-profile inspection check Without SSL inspection, IPS/AV can only see limited metadata for HTTPS traffic. Use certificate inspection by default and deep inspection where policy allows. Now we can configure inspection for AntiVirus profiles. Scope: Configuring the firewall policy's, they are compliant when all active rules have SSL-SSH-Inspection with deep-inspection or certificate-inspectionand and the active rules have an File-filter-profile inspection security profile. Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and File-filter-profile inspection correctly configured. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_VDOM_INSPECTION_LOGGING Firewall policy event logging Log of traffic across the network to see events happen. Scope: Configuring the firewall policy's, they are compliant when all active rules have logging turned on. Score = compliant / total * 100. Returns 100 if disabled or all rules have SSL-SSH-inspection and File-filter-profile inspection correctly configured. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING Firewall policy enable logging on the implicit deny rule Implicit deny logging increases visibility into blocked traffic and helps validate policy completeness. Scope: Configuring the firewall policy's default deny rule, they are compliant when ipv4 and ipv6 logging are turned on. Score = compliant / total * 100. Returns 100 when both ipv4 and ipv6 logging are correctly configured. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_BOOL_INTERFACE_MANAGEMENT_ACCESS Management access should be restricted to dedicated interfaces Limit management protocols (HTTPS, SSH) to dedicated management interfaces only. Management access should not be enabled on WAN or untrusted interfaces. Scope: System interface configuration. Compliant when management-facing interfaces (typically WAN) do not include https or ssh in their allowaccess setting. Binary: 100 if no WAN/untrusted interfaces have https or ssh access, 0 otherwise. Interface security FORTINET_FIREWALL
BP_FORTIFW_REPORT_VDOM_INSPECTION_MODE Firewall policies should use flow-based inspection Flow-based inspection provides better performance and modern security profile integration compared to the legacy proxy-based inspection mode. When available, policies should use flow-based inspection. Scope: Firewall policy inspection-mode configuration in VDOMs. Compliant when policies specify inspection-mode as 'flow'. Note: This field may not exist in newer FortiOS versions (7.6.0+). Score = compliant / total * 100. Returns 100 if all policies use flow-based inspection or field doesn't exist. Returns 0 if any policy uses proxy mode. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_BOOL_VDOM_ZONES Firewall policies should use zones instead of individual interfaces Organizing interfaces into zones simplifies firewall policy management and makes maintenance easier when interface configurations change. Scope: System zone configuration in VDOMs. Compliant when at least one zone is defined. Binary: 100 if at least 1 zone is configured, 0 if no zones defined. VDOM configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_IPSEC_IKEV2 IPsec should use IKEv2 for Phase 1 negotiations IKEv2 provides better security, faster negotiation, and improved stability compared to IKEv1. All IPsec Phase 1 interfaces should be configured to use IKEv2. Scope: IPsec Phase 1 interface configuration (vpn_ipsec_phase1-interface). Compliant when ike-version is set to 2 for all interfaces. Percentage: Score = (compliant Phase 1 interfaces / total Phase 1 interfaces) * 100. 100 if all Phase 1 interfaces use IKEv2, scales down for mixed deployments. IPsec VPN Configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_IPSEC_ENCRYPTION IPsec should use secure encryption and authentication algorithms IPsec proposals should not use weak cryptographic algorithms. Weak algorithms include: DES, 3DES, AES128, MD5, SHA1, and DH1-DH5. Use AES256 or stronger for encryption, SHA256 or stronger for authentication. Scope: IPsec Phase 1 and Phase 2 proposals (vpn_ipsec_phase1-interface and vpn_ipsec_phase2-interface). A tunnel is compliant when BOTH its Phase 1 and all linked Phase 2 interfaces have no weak algorithms. Percentage: Score = (compliant tunnels / total tunnels) * 100. 100 if all tunnels use strong ciphers/hashes, scales down for mixed compliance. IPsec VPN Configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_SDWAN_DESIGN SD-WAN should not use default zone Do not use the default SD-WAN zone (virtual-wan-link). Split into UNDERLAY and OVERLAY zones. Using explicit zones makes intent clear (transport vs tunnels) and keeps routing and policies consistent across sites. UNDERLAY typically contains Internet/MPLS links; OVERLAY contains IPsec tunnels. Scope: SD-WAN configuration (system sdwan) and zones. Compliant when SD-WAN is disabled OR when SD-WAN is enabled but the default 'virtual-wan-link' zone is not used. Binary: 100 if SD-WAN is disabled OR default zone is not used, 0 if SD-WAN is enabled with default zone. SD-WAN Configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_SDWAN_ZONES_COUNT SD-WAN should have at least 2 zones when enabled When SD-WAN is enabled, there should be at least 2 zones to support proper separation between underlay transport and overlay tunnels. Scope: SD-WAN configuration (system sdwan) and zones. Compliant when SD-WAN is disabled OR when SD-WAN is enabled with at least 2 zones configured. Binary: 100 if SD-WAN is disabled OR has at least 2 zones, 0 if SD-WAN is enabled with fewer than 2 zones. SD-WAN Configuration FORTINET_FIREWALL
BP_FORTIFW_REPORT_DOS_POLICY_EXISTS DoS policy should be configured on WAN/virtual-wan-link interfaces Denial-of-Service protection policies should be configured on external-facing interfaces (WAN or virtual-wan-link) to detect and mitigate various DoS attacks. If no DoS policies are configured, the device is considered non-compliant. Scope: DoS policy configuration (firewall_dos-policy). Compliant when at least one DoS policy is configured with interface set to 'WAN' or 'virtual-wan-link'. Binary: 100 if DoS policy exists on WAN/virtual-wan-link, 0 otherwise. DoS Protection FORTINET_FIREWALL
BP_FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED DoS policy baseline anomalies should be enabled The baseline DoS anomalies (TCP SYN flood, UDP flood, ICMP flood) should be enabled in DoS policies to provide core protection against volumetric attacks. If no DoS policies are configured, the check returns 0% compliance. Scope: DoS policy anomaly configurations. Compliant when tcp_syn_flood, udp_flood, and icmp_flood anomalies are enabled in policies on external interfaces. Percentage: (enabled_anomalies / 3) * 100 where 3 is the count of baseline anomalies (tcp_syn, udp, icmp). DoS Protection FORTINET_FIREWALL
BP_FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS DoS policy baseline thresholds should be customized (non-default) Each baseline DoS anomaly should have a custom threshold value (not factory default) configured to establish the rate at which the anomaly detection is triggered based on organization-specific needs. If no DoS policies are configured, the check returns 0% compliance. Scope: DoS policy anomaly thresholds. Compliant when tcp_syn_flood, udp_flood, and icmp_flood have CUSTOM thresholds (not defaults: 2000, 2000, 250 respectively). Percentage: (custom_thresholds / 3) * 100 where threshold is not the factory default value. DoS Protection FORTINET_FIREWALL
BP_FORTIFW_REPORT_DOS_BASELINE_ACTIONS DoS policy baseline actions should have blocking and logging enabled Each baseline DoS anomaly should have its action set to 'block' and logging enabled to ensure threats are blocked and recorded. If no DoS policies are configured, the check returns 0% compliance. Scope: DoS policy anomaly actions. Compliant when tcp_syn_flood, udp_flood, and icmp_flood have action='block' AND log=true. Percentage: (compliant_actions / 3) * 100 where an anomaly is compliant if action='block' and log=true. DoS Protection FORTINET_FIREWALL

Evidence Types

EvidenceType.name EvidenceType.description EvidenceType.value EvidenceType.source
Check timezone configuration Bool for correct configuration of timezone. FORTIFW_BOOL_TIME_ZONE Fortinet Firewall
Check NTP server configuration Bool for correct configuration of ntp server. FORTIFW_BOOL_NTP_CONFIG Fortinet Firewall
Check admin login lockout policy Bool for correct configuration of admin lockout policy. FORTIFW_BOOL_ADMIN_LOCKOUT_POLICY Fortinet Firewall
Check admin default disabled Bool for correct configuration of default admin disabled. FORTIFW_BOOL_ADMIN_DEFAULT_DISABLED Fortinet Firewall
Check admin backup user Bool for correct configuration of secondary admin. FORTIFW_BOOL_ADMIN_BACKUPS Fortinet Firewall
Check admin HTTPS port configuration Bool for correct configuration of admin HTTPS ports and settings. FORTIFW_BOOL_HTTPS_ADMIN_PORTS Fortinet Firewall
Check admin SSH port configuration Bool for correct configuration of admin SSH ports and settings. FORTIFW_BOOL_SSH_ADMIN_PORTS Fortinet Firewall
Check auto-firmware-upgrade status Bool for correct configuration of auto firmware upgrade. FORTIFW_BOOL_AUTO_FIRMWARE_UPGRADE Fortinet Firewall
Check password policy configuration Bool for correct configuration of password policy. FORTIFW_REPORT_PASSWORD_POLICY Fortinet Firewall
Check admin two-factor authentication Bool for correct configuration of two-factor authentication. FORTIFW_REPORT_ADMIN_TWO_FACTOR Fortinet Firewall
Check admin login location restriction Bool for correct configuration of admin login location restriction. FORTIFW_REPORT_ADMIN_RESTRICTED_LOGIN Fortinet Firewall
Check admin server certificate Bool for correct configuration of admin server certificate. FORTIFW_BOOL_ADMIN_SERVER_CERTIFICATE Fortinet Firewall
Check SNMP configuration Bool for correct configuration of SNMP. FORTIFW_REPORT_SNMP_CONFIGURATION Fortinet Firewall
Check IPS global configuration Bool for correct configuration of ips signature check. FORTIFW_REPORT_IPS_GLOBAL_CONFIGURATION Fortinet Firewall
Check SSL-VPN disabled Bool for correct configuration of SSL-VPN disabled status. FORTIFW_BOOL_SSL_VPN_DISABLED Fortinet Firewall
Check interface management access restriction Bool for correct configuration of management access on interfaces. FORTIFW_BOOL_INTERFACE_MANAGEMENT_ACCESS Fortinet Firewall
Check High availibility mode configuration Bool for correct configuration of High availibility mode check. FORTIFW_REPORT_HA_MODE_CONFIGURATION Fortinet Firewall
Check High availibility configuration Bool for correct configuration of High availibility heartbeat devices check. FORTIFW_REPORT_HA_HEARTBEAT_DEVICE_CONFIGURATION Fortinet Firewall
Check High availibility configuration Bool for correct configuration of High availibility heartbeat devices not also monitor check. FORTIFW_REPORT_HA_MONITOR_CONFIGURATION Fortinet Firewall
Check High availibility configuration Bool for correct configuration of High availibility session pickup check. FORTIFW_REPORT_HA_SESSION_PICKUP_CONFIGURATION Fortinet Firewall
Check VDOM setting ngfw mode Bool for correct configuration of ngfw-mode. FORTIFW_REPORT_VDOM_NGFW_MODE Fortinet Firewall
Check VDOM firewall policy Report of firewall policy rules that are in violation. FORTIFW_REPORT_VDOM_ANY_ANY_RULES Fortinet Firewall
Check VDOM firewall policy Report of firewall policy rules that are in violation. FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION Fortinet Firewall
Check VDOM firewall policy Report of firewall policy rules that are in violation. FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION Fortinet Firewall
Check VDOM firewall policy Report of firewall policy rules that are in violation. FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION Fortinet Firewall
Check VDOM firewall policy Report of firewall policy rules that are in violation. FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION Fortinet Firewall
Check VDOM firewall policy Report of firewall policy rules that are in violation. FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION Fortinet Firewall
Check VDOM firewall policy Report of firewall policy rules that are in violation. FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION Fortinet Firewall
Check VDOM firewall policy Report of firewall policy rules that are in violation. FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION Fortinet Firewall
Check VDOM firewall policy Report of firewall policy rules that are in violation. FORTIFW_REPORT_VDOM_INSPECTION_LOGGING Fortinet Firewall
Check VDOM firewall policy inspection mode Report of firewall policies not using flow-based inspection mode. FORTIFW_REPORT_VDOM_INSPECTION_MODE Fortinet Firewall
Check VDOM zones configuration Check whether VDOM has at least one zone configured. FORTIFW_BOOL_VDOM_ZONES Fortinet Firewall
Check VDOM firewall policy implicit deny Report of firewall policy implicit deny logging that are in violation. FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING Fortinet Firewall
Check IPsec Phase 1 IKEv2 usage Check whether IPsec Phase 1 interfaces are using IKEv2. FORTIFW_REPORT_IPSEC_IKEV2 Fortinet Firewall
Check IPsec encryption standards Check whether IPsec uses secure encryption and authentication algorithms. FORTIFW_REPORT_IPSEC_ENCRYPTION Fortinet Firewall
Check SD-WAN design Check whether SD-WAN uses a custom zone design instead of default virtual-wan-link. FORTIFW_REPORT_SDWAN_DESIGN Fortinet Firewall
Check SD-WAN zones count Check whether SD-WAN has at least 2 zones when enabled. FORTIFW_REPORT_SDWAN_ZONES_COUNT Fortinet Firewall
Check DoS policy exists on external interfaces Check whether DoS policy is configured on WAN or virtual-wan-link interfaces. FORTIFW_REPORT_DOS_POLICY_EXISTS Fortinet Firewall
Check DoS baseline anomalies are enabled Check whether baseline DoS anomalies (TCP SYN, UDP, ICMP) are enabled in policies. FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED Fortinet Firewall
Check DoS baseline thresholds are configured Check whether baseline DoS anomalies have thresholds > 0. FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS Fortinet Firewall
Check DoS baseline actions are configured Check whether baseline DoS anomalies have action='block' and logging enabled. FORTIFW_REPORT_DOS_BASELINE_ACTIONS Fortinet Firewall

Output

Best Practice Scores

BestPracticeScore.best_practice BestPracticeScore.domain BestPracticeScore.category BestPracticeScore.score BestPracticeScore.evidence_ids
BP_FORTIFW_BOOL_TIME_ZONE Hades Device Configuration 100% —
BP_FORTIFW_BOOL_NTP_CONFIG Hades Device Configuration 100% —
BP_FORTIFW_BOOL_ADMIN_LOCKOUT_POLICY Hades Admin user configuration 50% FORTIFW_BOOL_ADMIN_LOCKOUT_POLICY
BP_FORTIFW_BOOL_HTTPS_ADMIN_PORTS Hades Admin access configuration 0% FORTIFW_BOOL_HTTPS_ADMIN_PORTS
BP_FORTIFW_BOOL_SSH_ADMIN_PORTS Hades Admin access configuration 0% FORTIFW_BOOL_SSH_ADMIN_PORTS
BP_FORTIFW_BOOL_AUTO_FIRMWARE_UPGRADE Hades Device Configuration 0% FORTIFW_BOOL_AUTO_FIRMWARE_UPGRADE
BP_FORTIFW_BOOL_ADMIN_DEFAULT_DISABLED Hades Admin user configuration 0% FORTIFW_BOOL_ADMIN_DEFAULT_DISABLED
BP_FORTIFW_BOOL_ADMIN_BACKUPS Hades Admin user configuration 100% —
BP_FORTIFW_REPORT_PASSWORD_POLICY Hades Admin user configuration 100% —
BP_FORTIFW_REPORT_ADMIN_TWO_FACTOR Hades Admin user configuration 100% —
BP_FORTIFW_REPORT_ADMIN_RESTRICTED_LOGIN Hades Admin user configuration 0% FORTIFW_REPORT_ADMIN_RESTRICTED_LOGIN
BP_FORTIFW_BOOL_ADMIN_SERVER_CERTIFICATE Hades Admin user configuration 0% FORTIFW_BOOL_ADMIN_SERVER_CERTIFICATE
BP_FORTIFW_REPORT_SNMP_CONFIGURATION Hades Management Configuration 25% FORTIFW_REPORT_SNMP_CONFIGURATION
BP_FORTIFW_REPORT_IPS_GLOBAL_CONFIGURATION Hades Management Configuration 100% —
BP_FORTIFW_BOOL_SSL_VPN_DISABLED Hades Remote Access Configuration 0% FORTIFW_BOOL_SSL_VPN_DISABLED
BP_FORTIFW_BOOL_INTERFACE_MANAGEMENT_ACCESS Hades Interface security 50% FORTIFW_BOOL_INTERFACE_MANAGEMENT_ACCESS
BP_FORTIFW_REPORT_HA_MODE_CONFIGURATION Hades Management Configuration 100% —
BP_FORTIFW_REPORT_HA_HEARTBEAT_DEVICE_CONFIGURATION Hades Management Configuration 0% FORTIFW_REPORT_HA_HEARTBEAT_DEVICE_CONFIGURATION
BP_FORTIFW_REPORT_HA_MONITOR_CONFIGURATION Hades Management Configuration 100% —
BP_FORTIFW_REPORT_HA_SESSION_PICKUP_CONFIGURATION Hades Management Configuration 100% —
BP_FORTIFW_REPORT_VDOM_NGFW_MODE Hades/VDOM-A Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_ANY_ANY_RULES Hades/VDOM-A Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION Hades/VDOM-A Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION Hades/VDOM-A Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION Hades/VDOM-A Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION Hades/VDOM-A Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION Hades/VDOM-A Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION Hades/VDOM-A Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION Hades/VDOM-A Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_INSPECTION_LOGGING Hades/VDOM-A Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_INSPECTION_MODE Hades/VDOM-A Vdom Configuration 100% —
BP_FORTIFW_BOOL_VDOM_ZONES Hades/VDOM-A Vdom Configuration 0% FORTIFW_BOOL_VDOM_ZONES
BP_FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING Hades/VDOM-A Vdom Configuration 0% FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING
BP_FORTIFW_REPORT_IPSEC_IKEV2 Hades/VDOM-A IPsec VPN Configuration 100% —
BP_FORTIFW_REPORT_IPSEC_ENCRYPTION Hades/VDOM-A IPsec VPN Configuration 100% —
BP_FORTIFW_REPORT_SDWAN_DESIGN Hades/VDOM-A SD-WAN Configuration 0% FORTIFW_REPORT_SDWAN_DESIGN
BP_FORTIFW_REPORT_SDWAN_ZONES_COUNT Hades/VDOM-A SD-WAN Configuration 0% FORTIFW_REPORT_SDWAN_ZONES_COUNT
BP_FORTIFW_REPORT_DOS_POLICY_EXISTS Hades/VDOM-A DoS Protection 0% FORTIFW_REPORT_DOS_POLICY_EXISTS
BP_FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED Hades/VDOM-A DoS Protection 0% FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED
BP_FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS Hades/VDOM-A DoS Protection 0% FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS
BP_FORTIFW_REPORT_DOS_BASELINE_ACTIONS Hades/VDOM-A DoS Protection 0% FORTIFW_REPORT_DOS_BASELINE_ACTIONS
BP_FORTIFW_REPORT_VDOM_NGFW_MODE Hades/VDOM-B Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_ANY_ANY_RULES Hades/VDOM-B Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION Hades/VDOM-B Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION Hades/VDOM-B Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION Hades/VDOM-B Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION Hades/VDOM-B Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION Hades/VDOM-B Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION Hades/VDOM-B Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION Hades/VDOM-B Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_INSPECTION_LOGGING Hades/VDOM-B Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_INSPECTION_MODE Hades/VDOM-B Vdom Configuration 100% —
BP_FORTIFW_BOOL_VDOM_ZONES Hades/VDOM-B Vdom Configuration 0% FORTIFW_BOOL_VDOM_ZONES
BP_FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING Hades/VDOM-B Vdom Configuration 0% FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING
BP_FORTIFW_REPORT_IPSEC_IKEV2 Hades/VDOM-B IPsec VPN Configuration 100% —
BP_FORTIFW_REPORT_IPSEC_ENCRYPTION Hades/VDOM-B IPsec VPN Configuration 100% —
BP_FORTIFW_REPORT_SDWAN_DESIGN Hades/VDOM-B SD-WAN Configuration 0% FORTIFW_REPORT_SDWAN_DESIGN
BP_FORTIFW_REPORT_SDWAN_ZONES_COUNT Hades/VDOM-B SD-WAN Configuration 0% FORTIFW_REPORT_SDWAN_ZONES_COUNT
BP_FORTIFW_REPORT_DOS_POLICY_EXISTS Hades/VDOM-B DoS Protection 0% FORTIFW_REPORT_DOS_POLICY_EXISTS
BP_FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED Hades/VDOM-B DoS Protection 0% FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED
BP_FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS Hades/VDOM-B DoS Protection 0% FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS
BP_FORTIFW_REPORT_DOS_BASELINE_ACTIONS Hades/VDOM-B DoS Protection 0% FORTIFW_REPORT_DOS_BASELINE_ACTIONS
BP_FORTIFW_REPORT_VDOM_NGFW_MODE Hades/root Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_ANY_ANY_RULES Hades/root Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION Hades/root Vdom Configuration 0% FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION
BP_FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION Hades/root Vdom Configuration 0% FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION
BP_FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION Hades/root Vdom Configuration 0% FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION
BP_FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION Hades/root Vdom Configuration 0% FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION
BP_FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION Hades/root Vdom Configuration 0% FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION
BP_FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION Hades/root Vdom Configuration 0% FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION
BP_FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION Hades/root Vdom Configuration 0% FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION
BP_FORTIFW_REPORT_VDOM_INSPECTION_LOGGING Hades/root Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_INSPECTION_MODE Hades/root Vdom Configuration 100% —
BP_FORTIFW_BOOL_VDOM_ZONES Hades/root Vdom Configuration 0% FORTIFW_BOOL_VDOM_ZONES
BP_FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING Hades/root Vdom Configuration 0% FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING
BP_FORTIFW_REPORT_IPSEC_IKEV2 Hades/root IPsec VPN Configuration 100% —
BP_FORTIFW_REPORT_IPSEC_ENCRYPTION Hades/root IPsec VPN Configuration 100% —
BP_FORTIFW_REPORT_SDWAN_DESIGN Hades/root SD-WAN Configuration 0% FORTIFW_REPORT_SDWAN_DESIGN
BP_FORTIFW_REPORT_SDWAN_ZONES_COUNT Hades/root SD-WAN Configuration 0% FORTIFW_REPORT_SDWAN_ZONES_COUNT
BP_FORTIFW_REPORT_DOS_POLICY_EXISTS Hades/root DoS Protection 0% FORTIFW_REPORT_DOS_POLICY_EXISTS
BP_FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED Hades/root DoS Protection 0% FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED
BP_FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS Hades/root DoS Protection 0% FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS
BP_FORTIFW_REPORT_DOS_BASELINE_ACTIONS Hades/root DoS Protection 0% FORTIFW_REPORT_DOS_BASELINE_ACTIONS
BP_FORTIFW_REPORT_VDOM_NGFW_MODE Hades/test_conf2 Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_ANY_ANY_RULES Hades/test_conf2 Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION Hades/test_conf2 Vdom Configuration 75% FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION
BP_FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION Hades/test_conf2 Vdom Configuration 75% FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION
BP_FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION Hades/test_conf2 Vdom Configuration 75% FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION
BP_FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION Hades/test_conf2 Vdom Configuration 75% FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION
BP_FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION Hades/test_conf2 Vdom Configuration 75% FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION
BP_FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION Hades/test_conf2 Vdom Configuration 75% FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION
BP_FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION Hades/test_conf2 Vdom Configuration 75% FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION
BP_FORTIFW_REPORT_VDOM_INSPECTION_LOGGING Hades/test_conf2 Vdom Configuration 75% FORTIFW_REPORT_VDOM_INSPECTION_LOGGING
BP_FORTIFW_REPORT_VDOM_INSPECTION_MODE Hades/test_conf2 Vdom Configuration 100% —
BP_FORTIFW_BOOL_VDOM_ZONES Hades/test_conf2 Vdom Configuration 0% FORTIFW_BOOL_VDOM_ZONES
BP_FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING Hades/test_conf2 Vdom Configuration 0% FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING
BP_FORTIFW_REPORT_IPSEC_IKEV2 Hades/test_conf2 IPsec VPN Configuration 100% —
BP_FORTIFW_REPORT_IPSEC_ENCRYPTION Hades/test_conf2 IPsec VPN Configuration 100% —
BP_FORTIFW_REPORT_SDWAN_DESIGN Hades/test_conf2 SD-WAN Configuration 0% FORTIFW_REPORT_SDWAN_DESIGN
BP_FORTIFW_REPORT_SDWAN_ZONES_COUNT Hades/test_conf2 SD-WAN Configuration 100% —
BP_FORTIFW_REPORT_DOS_POLICY_EXISTS Hades/test_conf2 DoS Protection 0% FORTIFW_REPORT_DOS_POLICY_EXISTS
BP_FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED Hades/test_conf2 DoS Protection 100% FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED
BP_FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS Hades/test_conf2 DoS Protection 50% FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS
BP_FORTIFW_REPORT_DOS_BASELINE_ACTIONS Hades/test_conf2 DoS Protection 100% FORTIFW_REPORT_DOS_BASELINE_ACTIONS
BP_FORTIFW_REPORT_VDOM_NGFW_MODE Hades/test_config Vdom Configuration 0% FORTIFW_REPORT_VDOM_NGFW_MODE
BP_FORTIFW_REPORT_VDOM_ANY_ANY_RULES Hades/test_config Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION Hades/test_config Vdom Configuration 50% FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION
BP_FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION Hades/test_config Vdom Configuration 50% FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION
BP_FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION Hades/test_config Vdom Configuration 50% FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION
BP_FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION Hades/test_config Vdom Configuration 50% FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION
BP_FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION Hades/test_config Vdom Configuration 50% FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION
BP_FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION Hades/test_config Vdom Configuration 50% FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION
BP_FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION Hades/test_config Vdom Configuration 50% FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION
BP_FORTIFW_REPORT_VDOM_INSPECTION_LOGGING Hades/test_config Vdom Configuration 100% —
BP_FORTIFW_REPORT_VDOM_INSPECTION_MODE Hades/test_config Vdom Configuration 100% —
BP_FORTIFW_BOOL_VDOM_ZONES Hades/test_config Vdom Configuration 0% FORTIFW_BOOL_VDOM_ZONES
BP_FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING Hades/test_config Vdom Configuration 0% FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING
BP_FORTIFW_REPORT_IPSEC_IKEV2 Hades/test_config IPsec VPN Configuration 0% FORTIFW_REPORT_IPSEC_IKEV2
BP_FORTIFW_REPORT_IPSEC_ENCRYPTION Hades/test_config IPsec VPN Configuration 100% —
BP_FORTIFW_REPORT_SDWAN_DESIGN Hades/test_config SD-WAN Configuration 0% FORTIFW_REPORT_SDWAN_DESIGN
BP_FORTIFW_REPORT_SDWAN_ZONES_COUNT Hades/test_config SD-WAN Configuration 0% FORTIFW_REPORT_SDWAN_ZONES_COUNT
BP_FORTIFW_REPORT_DOS_POLICY_EXISTS Hades/test_config DoS Protection 0% FORTIFW_REPORT_DOS_POLICY_EXISTS
BP_FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED Hades/test_config DoS Protection 0% FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED
BP_FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS Hades/test_config DoS Protection 0% FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS
BP_FORTIFW_REPORT_DOS_BASELINE_ACTIONS Hades/test_config DoS Protection 0% FORTIFW_REPORT_DOS_BASELINE_ACTIONS

Evidences

EvidenceType Evidence.domain Evidence.name Evidence.value_type Evidence.value
FORTIFW_BOOL_ADMIN_LOCKOUT_POLICY Hades Hades - FORTIFW_BOOL_ADMIN_LOCKOUT_POLICY TEXT 0
FORTIFW_BOOL_HTTPS_ADMIN_PORTS Hades Hades - FORTIFW_BOOL_HTTPS_ADMIN_PORTS TEXT 0
FORTIFW_BOOL_SSH_ADMIN_PORTS Hades Hades - FORTIFW_BOOL_SSH_ADMIN_PORTS TEXT 0
FORTIFW_BOOL_AUTO_FIRMWARE_UPGRADE Hades Hades - FORTIFW_BOOL_AUTO_FIRMWARE_UPGRADE TEXT 0
FORTIFW_BOOL_ADMIN_DEFAULT_DISABLED Hades Hades - FORTIFW_BOOL_ADMIN_DEFAULT_DISABLED TEXT 0
FORTIFW_REPORT_ADMIN_RESTRICTED_LOGIN Hades Hades - FORTIFW_REPORT_ADMIN_RESTRICTED_LOGIN TEXT 0
FORTIFW_BOOL_ADMIN_SERVER_CERTIFICATE Hades Hades - FORTIFW_BOOL_ADMIN_SERVER_CERTIFICATE TEXT 0
FORTIFW_REPORT_SNMP_CONFIGURATION Hades Hades - FORTIFW_REPORT_SNMP_CONFIGURATION TEXT 1
FORTIFW_BOOL_SSL_VPN_DISABLED Hades Hades - FORTIFW_BOOL_SSL_VPN_DISABLED TEXT 0
FORTIFW_BOOL_INTERFACE_MANAGEMENT_ACCESS Hades Hades - FORTIFW_BOOL_INTERFACE_MANAGEMENT_ACCESS TEXT 0
FORTIFW_REPORT_HA_HEARTBEAT_DEVICE_CONFIGURATION Hades Hades - FORTIFW_REPORT_HA_HEARTBEAT_DEVICE_CONFIGURATION TEXT 0
FORTIFW_BOOL_VDOM_ZONES Hades/VDOM-A Hades/VDOM-A - FORTIFW_BOOL_VDOM_ZONES TEXT 0
FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING Hades/VDOM-A Hades/VDOM-A - FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING TEXT 0
FORTIFW_REPORT_SDWAN_DESIGN Hades/VDOM-A Hades/VDOM-A - FORTIFW_REPORT_SDWAN_DESIGN TEXT 0
FORTIFW_REPORT_SDWAN_ZONES_COUNT Hades/VDOM-A Hades/VDOM-A - FORTIFW_REPORT_SDWAN_ZONES_COUNT TEXT 0
FORTIFW_REPORT_DOS_POLICY_EXISTS Hades/VDOM-A Hades/VDOM-A - FORTIFW_REPORT_DOS_POLICY_EXISTS TEXT 0
FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED Hades/VDOM-A Hades/VDOM-A - FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED TEXT 0
FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS Hades/VDOM-A Hades/VDOM-A - FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS TEXT 0
FORTIFW_REPORT_DOS_BASELINE_ACTIONS Hades/VDOM-A Hades/VDOM-A - FORTIFW_REPORT_DOS_BASELINE_ACTIONS TEXT 0
FORTIFW_BOOL_VDOM_ZONES Hades/VDOM-B Hades/VDOM-B - FORTIFW_BOOL_VDOM_ZONES TEXT 0
FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING Hades/VDOM-B Hades/VDOM-B - FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING TEXT 0
FORTIFW_REPORT_SDWAN_DESIGN Hades/VDOM-B Hades/VDOM-B - FORTIFW_REPORT_SDWAN_DESIGN TEXT 0
FORTIFW_REPORT_SDWAN_ZONES_COUNT Hades/VDOM-B Hades/VDOM-B - FORTIFW_REPORT_SDWAN_ZONES_COUNT TEXT 0
FORTIFW_REPORT_DOS_POLICY_EXISTS Hades/VDOM-B Hades/VDOM-B - FORTIFW_REPORT_DOS_POLICY_EXISTS TEXT 0
FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED Hades/VDOM-B Hades/VDOM-B - FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED TEXT 0
FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS Hades/VDOM-B Hades/VDOM-B - FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS TEXT 0
FORTIFW_REPORT_DOS_BASELINE_ACTIONS Hades/VDOM-B Hades/VDOM-B - FORTIFW_REPORT_DOS_BASELINE_ACTIONS TEXT 0
FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION Hades/root Hades/root - FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION TEXT policy_id,policy_name,violator 3,Block_jarviss.be,no-inspection 1,Lan-internet,no-inspection
FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION Hades/root Hades/root - FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION TEXT policy_id,policy_name,violator 3,Block_jarviss.be,no-inspection 1,Lan-internet,no-inspection
FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION Hades/root Hades/root - FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION TEXT policy_id,policy_name,violator 3,Block_jarviss.be,no-inspection 1,Lan-internet,no-inspection
FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION Hades/root Hades/root - FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION TEXT policy_id,policy_name,violator 3,Block_jarviss.be,no-inspection 1,Lan-internet,no-inspection
FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION Hades/root Hades/root - FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION TEXT policy_id,policy_name,violator 3,Block_jarviss.be,no-inspection 1,Lan-internet,no-inspection
FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION Hades/root Hades/root - FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION TEXT policy_id,policy_name,violator 3,Block_jarviss.be,no-inspection 1,Lan-internet,no-inspection
FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION Hades/root Hades/root - FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION TEXT policy_id,policy_name,violator 3,Block_jarviss.be,no-inspection 1,Lan-internet,no-inspection
FORTIFW_BOOL_VDOM_ZONES Hades/root Hades/root - FORTIFW_BOOL_VDOM_ZONES TEXT 0
FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING Hades/root Hades/root - FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING TEXT 0
FORTIFW_REPORT_SDWAN_DESIGN Hades/root Hades/root - FORTIFW_REPORT_SDWAN_DESIGN TEXT 0
FORTIFW_REPORT_SDWAN_ZONES_COUNT Hades/root Hades/root - FORTIFW_REPORT_SDWAN_ZONES_COUNT TEXT 0
FORTIFW_REPORT_DOS_POLICY_EXISTS Hades/root Hades/root - FORTIFW_REPORT_DOS_POLICY_EXISTS TEXT 0
FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED Hades/root Hades/root - FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED TEXT 0
FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS Hades/root Hades/root - FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS TEXT 0
FORTIFW_REPORT_DOS_BASELINE_ACTIONS Hades/root Hades/root - FORTIFW_REPORT_DOS_BASELINE_ACTIONS TEXT 0
FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION TEXT policy_id,policy_name,violator 4,test-no-sec-profiles,no-inspection
FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION TEXT policy_id,policy_name,violator 4,test-no-sec-profiles,no-inspection
FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION TEXT policy_id,policy_name,violator 4,test-no-sec-profiles,no-inspection
FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION TEXT policy_id,policy_name,violator 4,test-no-sec-profiles,no-inspection
FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION TEXT policy_id,policy_name,violator 4,test-no-sec-profiles,no-inspection
FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION TEXT policy_id,policy_name,violator 4,test-no-sec-profiles,no-inspection
FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION TEXT policy_id,policy_name,violator 4,test-no-sec-profiles,no-inspection
FORTIFW_REPORT_VDOM_INSPECTION_LOGGING Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_VDOM_INSPECTION_LOGGING TEXT 0
FORTIFW_BOOL_VDOM_ZONES Hades/test_conf2 Hades/test_conf2 - FORTIFW_BOOL_VDOM_ZONES TEXT 0
FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING TEXT 0
FORTIFW_REPORT_SDWAN_DESIGN Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_SDWAN_DESIGN TEXT 0
FORTIFW_REPORT_DOS_POLICY_EXISTS Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_DOS_POLICY_EXISTS TEXT 0
FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED TEXT 1
FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS TEXT 0
FORTIFW_REPORT_DOS_BASELINE_ACTIONS Hades/test_conf2 Hades/test_conf2 - FORTIFW_REPORT_DOS_BASELINE_ACTIONS TEXT 1
FORTIFW_REPORT_VDOM_NGFW_MODE Hades/test_config Hades/test_config - FORTIFW_REPORT_VDOM_NGFW_MODE TEXT 0
FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION Hades/test_config Hades/test_config - FORTIFW_REPORT_VDOM_SSL_SSH_INSPECTION TEXT policy_id,policy_name,violator 1,any any all,
FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION Hades/test_config Hades/test_config - FORTIFW_REPORT_VDOM_AV_PROFILE_INSPECTION TEXT policy_id,policy_name,violator 1,any any all,
FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION Hades/test_config Hades/test_config - FORTIFW_REPORT_VDOM_WEB_PROFILE_INSPECTION TEXT policy_id,policy_name,violator 1,any any all,
FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION Hades/test_config Hades/test_config - FORTIFW_REPORT_VDOM_DNS_PROFILE_INSPECTION TEXT policy_id,policy_name,violator 1,any any all,
FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION Hades/test_config Hades/test_config - FORTIFW_REPORT_VDOM_IPS_SENSOR_INSPECTION TEXT policy_id,policy_name,violator 1,any any all,
FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION Hades/test_config Hades/test_config - FORTIFW_REPORT_VDOM_APP_LIST_INSPECTION TEXT policy_id,policy_name,violator 1,any any all,
FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION Hades/test_config Hades/test_config - FORTIFW_REPORT_VDOM_FILE_FILTER_INSPECTION TEXT policy_id,policy_name,violator 1,any any all,
FORTIFW_BOOL_VDOM_ZONES Hades/test_config Hades/test_config - FORTIFW_BOOL_VDOM_ZONES TEXT 0
FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING Hades/test_config Hades/test_config - FORTIFW_REPORT_VDOM_IMPLICIT_LOGGING TEXT 0
FORTIFW_REPORT_IPSEC_IKEV2 Hades/test_config Hades/test_config - FORTIFW_REPORT_IPSEC_IKEV2 TEXT 0
FORTIFW_REPORT_SDWAN_DESIGN Hades/test_config Hades/test_config - FORTIFW_REPORT_SDWAN_DESIGN TEXT 0
FORTIFW_REPORT_SDWAN_ZONES_COUNT Hades/test_config Hades/test_config - FORTIFW_REPORT_SDWAN_ZONES_COUNT TEXT 0
FORTIFW_REPORT_DOS_POLICY_EXISTS Hades/test_config Hades/test_config - FORTIFW_REPORT_DOS_POLICY_EXISTS TEXT 0
FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED Hades/test_config Hades/test_config - FORTIFW_REPORT_DOS_BASELINE_ANOMALIES_ENABLED TEXT 0
FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS Hades/test_config Hades/test_config - FORTIFW_REPORT_DOS_BASELINE_THRESHOLDS TEXT 0
FORTIFW_REPORT_DOS_BASELINE_ACTIONS Hades/test_config Hades/test_config - FORTIFW_REPORT_DOS_BASELINE_ACTIONS TEXT 0