My FortiGate best practices baseline

The important thing up front, here is the GitHub link to the FortiGate best practices baseline: https://github.com/KevinGuenay/fortigate-baseline

Over the years, I have assembled my own baseline for FortiGates that I apply to basically every deployment. It contains sensible settings, some checks, best practices, and small things that not everyone knows about. I wanted it to be as generic as possible, so that it can be used for every situation. The baseline grew with experience and time, and I am finally getting around to sharing it with the world.

Points to consider

• I am not liable for any issues you experience when using any parts of my baseline.
• The baseline will get updates, but they will come when I get to it and when I feel the changes make sense.
• I won’t edit this post when I update the baseline. I will only update the files on GitHub. I might, however, make a “State of the baseline…”-style post in the future if it is warranted.
• I am assuming a few things for my baseline:
  • Internal and external traffic is handled on the same device. This is important for one point, which is highlighted.
  • No VDOMs are used. This doesn’t mean that the baseline can’t be used for VDOM deployments, but lots of things need to be handled differently if VDOMs are used.
  • An active internet connection is available. This isn’t necessary, but some things will not work without one.
• Only IPv4 will be handled. No IPv6 settings are provided.
• This is a CLI-first baseline. For some settings, both a GUI and a CLI way to configure exist. Due to the changing nature of the FortiGate GU, I will only provide the GUI way if necessary.
• I am not infallible. If you believe the baseline can be improved, create an issue or a pull request on GitHub, and I’ll look at it.
  • The baseline should stay as generic as possible and shouldn’t interfere with existing configurations (performance impacts are highlighted, and decisions are up to the end user), so requests to change the baseline will have to keep this in mind. To give an example of what I wouldn’t accept: Deleting the SIP session helper and disabling the SIP ALG. While such a configuration is often required, it can create problems.

The GitHub project

Publishing the baseline on GitHub is a no-brainer to me because of version control, issues, pull requests, availability, etc.

The way the GitHub project is structured is as follows:

• The README.md contains much of what I have written here
• The baseline.md is the important file and holds multiple sections
• Each section in the baseline.md covers one topic,  includes a description, and the CLI commands to configure the relevant topic
• A fortigate_baseline_no_input_safe.conf file is available that includes all safe CLI commands that can be immediately applied to a device and should be non-disruptive. The “no_input” refers to the fact that you don’t have to supply anything because, for some sections, you need to supply additional information, like interface names or services.
  • The only exception to the “safe” part is Private Data Encryption (PDE), because of how it interacts with FortiManager. This configuration includes PDE because it is highly recommended. PDE will always be the very first item.
• A fortigate_baseline_no_input_safe_create.conf is available that does everything the “no_input” file does, but also creates objects (addresses, security profiles, threat feeds, etc.), but does not use them. All created objects have the prefix “BASE_”.
  • The activation of FortiGate Cloud Sandbox is also included in this, even though it requires input.
• A fortigate_baseline.conf file is available that includes all CLI commands and has placeholders (e.g. “<###PLACEHOLDER_INTF###>”) for information you need to supply first.

That’s it

I genuinely hope that people find value in this baseline and that it grows with the input of everyone, to create better, more secure FortiGate installations.