Fortinet Document Library

Version:


Table of Contents

6.2.0
Download PDF
Copy Link

Security Best Practices

For stronger security, implement the following security best practices.

Administrator access best practices

  • Enable password policy and set requirements for the administrator password. The password policy lets you specify the administrator's password minimum length, type of characters it must contain, and the number of days to password expiry.
  • Use CLI commands to configure the administrator's password lockout and retry attempts.

    For example, to set the lockout duration to two attempts and set a two minute duration before the administrator can log in again, enter the following CLI commands:

    config system global

    set admin-lockout-threshold 2

    set admin-lockout-duration 120

    end

  • Set a lower idle timeout so that unattended workstations are logged out.
  • Use two-factor authentication and RADIUS authentication for administrators. For more information, see the Two-Factor Authenticator Interoperability Guide and FortiAuthenticator Administration Guide in the Fortinet Document Library.
  • Limit administrator access. For example, configure trusted hosts and allowaccess.

Encryption best practices

Set a strong encryption level. Use the SSL protocol version (TLS version) that meets PCI compliance or your organization’s security requirements. For example:

config system global

set fgfm-ssl-protocol tlsv1.2

set oftp-ssl-protocol tlsv1.2

set ssl-protocol tlsv1.2

set webservice-proto tlsv1.2

set ssl-low-encryption disable

end

 

config fmupdate fds-setting

set fds-ssl-protocol tlsv1.2

end

For more information, see the applicable knowledge base article: Setting SSL Protocol Version on FortiManager and Setting SSL Protocol Version on FortiAnalyzer.

Other security best practices

  • Disable unused interfaces.
  • Upgrade firmware to the latest version.
  • Install physical devices in a restricted area.
  • Set up NTP. For example:

    config system ntp

    set status enable

    set sync_interval 60

    config ntpserver

    edit 1

    set server {<address_ipv4> | <fqdn_str>}

    end

    end

    end

     

  • For audit purposes:
    • Use named accounts wherever possible.
    • Send logs to a central log destination.
Do not lose the administrator log in information as there is no password recovery mechanism in FortiAnalyzer 5.4.0 and later.

Security Best Practices

For stronger security, implement the following security best practices.

Administrator access best practices

  • Enable password policy and set requirements for the administrator password. The password policy lets you specify the administrator's password minimum length, type of characters it must contain, and the number of days to password expiry.
  • Use CLI commands to configure the administrator's password lockout and retry attempts.

    For example, to set the lockout duration to two attempts and set a two minute duration before the administrator can log in again, enter the following CLI commands:

    config system global

    set admin-lockout-threshold 2

    set admin-lockout-duration 120

    end

  • Set a lower idle timeout so that unattended workstations are logged out.
  • Use two-factor authentication and RADIUS authentication for administrators. For more information, see the Two-Factor Authenticator Interoperability Guide and FortiAuthenticator Administration Guide in the Fortinet Document Library.
  • Limit administrator access. For example, configure trusted hosts and allowaccess.

Encryption best practices

Set a strong encryption level. Use the SSL protocol version (TLS version) that meets PCI compliance or your organization’s security requirements. For example:

config system global

set fgfm-ssl-protocol tlsv1.2

set oftp-ssl-protocol tlsv1.2

set ssl-protocol tlsv1.2

set webservice-proto tlsv1.2

set ssl-low-encryption disable

end

 

config fmupdate fds-setting

set fds-ssl-protocol tlsv1.2

end

For more information, see the applicable knowledge base article: Setting SSL Protocol Version on FortiManager and Setting SSL Protocol Version on FortiAnalyzer.

Other security best practices

  • Disable unused interfaces.
  • Upgrade firmware to the latest version.
  • Install physical devices in a restricted area.
  • Set up NTP. For example:

    config system ntp

    set status enable

    set sync_interval 60

    config ntpserver

    edit 1

    set server {<address_ipv4> | <fqdn_str>}

    end

    end

    end

     

  • For audit purposes:
    • Use named accounts wherever possible.
    • Send logs to a central log destination.
Do not lose the administrator log in information as there is no password recovery mechanism in FortiAnalyzer 5.4.0 and later.