BIOS-level signature and file integrity checking

The BIOS-level signature and integrity checking has been enhanced by enforcing each FortiOS GA firmware image, AV engine file, and IPS engine file to be dually-signed by the Fortinet CA and a third-party CA. The BIOS verifies that each file matches their secure hash as indicated by their certificates. Users are warned when there is a failed integrity check, and the system may be prevented from booting depending on the severity and the BIOS security level.

Signature checking occurs when the FortiOS firmware, AV, and IPS engine files are uploaded. This allows the FortiGate to warn users of potential risks involved with uploading an unauthenticated file.

The outcome of the signature and integrity check depends on the security level configured in BIOS and the certificate authority that signed the file.

The following table summarizes the use cases and the potential outcome based on the security level.

Use case	Certificate signed by		Outcome based on security level
	Fortinet CA	Third-party CA	Level 2	Level 1	Level 0
GA-Certified (GA firmware, Beta firmware, Top3 final builds)	Yes	Yes	Accept	Accept	Accept
Non-GA certified (Special builds: Top3 and NPI quick builds)	Yes	No	Warning	Accept	Accept
Interim and Dev builds, or unknown build	No	Yes or No	Reject	Warning	Accept

The security levels on the BIOS are:

• Level 2: in order to operate normally, FortiOS requires all file signatures to match their secure checksums as indicated on both Fortinet and third-party CA signed certificates.

  • If a file has a Fortinet CA signed certificate but no third-party signed certificates, then FortiOS can still run but displays a warning in the GUI and CLI.

  • If a file has no valid certificate signed by the Fortinet CA, then FortiOS is not allowed to run.

• Level 1: in order to operate normally, FortiOS only requires all file signatures to match their secure checksums as indicated on the Fortinet CA signed certificate.

  • If a file has no valid certificate signed by the Fortinet CA, then FortiOS can still run but displays a warning in the GUI and CLI.

• Level 0 (not recommended): FortiOS does not perform code verification.

On FortiGates without supported BIOS security levels, the device acts like security level 1. For example, on a FortiGate-VM that does not have BIOS, the security level is defaulted to level 1.

To verify the BIOS security level:

# get system status
Version: FortiGate-101F v6.4.13,build2092,230608 (GA.M)
Security Level: 2
Firmware Signature: certified

The following examples outline the different use cases when upgrading firmware and AV files on a FortiGate model that supports BIOS security levels, and a FortiGate model that does not support BIOS security levels.

For more information, see the Firmware section and Manual updates.

Upgrading on a device with BIOS security levels

The following use cases are applicable when upgrading firmware on a FortiGate with BIOS security levels. Firmware is upgraded using the System > Firmware page. In the following examples, the FortiOS version is upgraded from 6.4.12 to 6.4.13 and interim build numbers are used to demonstrate the functionality of this feature on a FortiGate 101F.

This feature is implemented on all FortiGate F-series models and E-series models released in 2019 and later.

Level 2

When upgrading with a dually-signed firmware image, FortiOS verifies the certificates and accepts the image. The following CLI output shows the messages displayed when a FortiGate is upgraded.

FortiGate_101F (global) # get system status
Version: FortiGate-101F v6.4.12,build2060,230221 (GA.M)
Firmware Signature: certified
Virus-DB: 1.00000(2018-04-09 18:07)
…
FortiGate_101F (global) # Image verification OK!
Firmware upgrade in progress ...

Done.

The system is going down NOW !!

Please stand by while rebooting the system.
Restarting system.
…

System is starting...

The config file may contain errors.
Please see details by the command 'diagnose debug config-error-log read'.

FortiGate_101F login: admin
Password:
Welcome!
			
FortiGate_101F (global) # get system status
Version: FortiGate-101F v6.4.13,build2092,230608 (GA.M)
Security Level: 2
Firmware Signature: certified

When upgrading with an unsigned firmware image in the GUI, FortiOS is unable to verify the certificates and rejects the image. A notification is displayed that This firmware image didn't pass the signature verification.

When uploading a dually-signed IPS engine file on the System > FortiGuard page, FortiOS verifies the certificates and accepts the file. A notification is displayed (Successfully upgraded database).

When uploading an unsigned IPS engine file on the System > FortiGuard page, FortiOS is unable to verify the certificates and rejects the file. A notification is displayed that the device Failed to upgrade database.

Level 1

When upgrading with a dually-signed firmware image, FortiOS verifies the certificates and accepts the image. No warning is displayed during the upgrade, or while the system is running in 6.4.13.

When upgrading with an unsigned firmware image in the GUI, FortiOS is unable to verify the certificates and the image fails verification. The upgrade will still occur. However, during the upgrade process, a warning dialog is displayed indicating that This firmware failed signature validation. The user can click Continue to upgrade the firmware.

When the user logs in to the FortiGate running 6.4.13, a warning dialog is displayed indicating that the Installed Firmware is Not Signed by Fortinet. The user can click I Understand The Risk to log in.

When the FortiGate is running unsigned firmware, warnings appear in the GUI and CLI.

• Top banner: a warning appears that the Installed firmware is not signed by Fortinet.

  

• Enter the following in the CLI to verify the firmware status:

  # get system status
  Version: FortiGate-VM64 v6.4.13,build2089,230526 (interim)
  Security Level: 1
  Firmware Signature: un-certified
  Virus-DB: 91.03113(2023-05-09 15:26)

When running uploading an unsigned IPS engine file on the System > FortiGuard page, FortiOS is unable to verify the certificates and the file fails verification. A warning dialog is displayed indicating that This package file has no signature for validation, but the user can click OK to use the file.

Level 0

When upgrading with a dually-signed firmware image, FortiOS verifies the certificates and accepts the image. No verification is performed.

When upgrading with an unsigned firmware image in the GUI, FortiOS does not verify the certificates. No warnings are displayed that the firmware is unverified.

Upgrading on a device without BIOS security levels

The following use cases are applicable when upgrading firmware and AV files on a FortiGate without BIOS security levels. Firmware is upgraded using the System > Firmware page, and AV files are upgraded using the System > FortiGuard page. A FortiGate 60E is used in these examples and acts like it has security level 1.

When upgrading from 6.4.12 to 6.4.13 with a dually-signed firmware image, FortiOS verifies the certificates and accepts the image.

When upgrading from 6.4.12 to 6.4.13 with an unsigned firmware image in the GUI, FortiOS is unable to verify the certificates and the image fails verification. A warning dialog is displayed indicating that This firmware failed signature validation, but the user can click Continue to use the firmware.

When running 6.4.13 and uploading an unsigned AV engine file on the System > FortiGuard page, FortiOS is unable to verify the certificates and the file fails verification. A warning dialog is displayed indicating that This package file has no signature for validation, but the user can click OK to use the file.