Security Best Practices

For stronger security, implement the following security best practices.

Administrator access best practices

• Enable password policy and set requirements for the administrator password. The password policy lets you specify the administrator's password minimum length, type of characters it must contain, and the number of days to password expiry.
• Use CLI commands to configure the administrator's password lockout and retry attempts.

  For example, to set the lockout duration to two attempts and set a two minute duration before the administrator can log in again, enter the following CLI commands:

  config system global

  set admin-lockout-threshold 2

  set admin-lockout-duration 120

  end

• Set a lower idle timeout so that unattended workstations are logged out.
• Use two-factor authentication and RADIUS authentication for administrators. For more information, see the Two-Factor Authenticator Interoperability Guide and FortiAuthenticator Administration Guide in the Fortinet Document Library.
• Limit administrator access. For example, configure trusted hosts and allowaccess.

Encryption best practices

Set a strong encryption level. Use the SSL protocol version (TLS version) that meets PCI compliance or your organization’s security requirements. For example:

config system global

set enc-algorithm high

set fgfm-ssl-protocol tlsv1.2

set oftp-ssl-protocol tlsv1.2

set ssl-protocol tlsv1.2

set webservice-proto tlsv1.2

set ssl-low-encryption disable

end

config fmupdate fds-setting

set fds-ssl-protocol tlsv1.2

end

The enc-algorithm setting allows you to specify the security levels for cipher suites.

• set enc-algorithm low uses all OpenSSL ciphers.

• set enc-algorithm medium uses high and medium OpenSSL ciphers.

• set enc-algorithm high (default) uses only high OpenSSL ciphers.

For more information, see the applicable knowledge base article: Setting SSL Protocol Version on FortiManager and Setting SSL Protocol Version on FortiAnalyzer.

Other security best practices

• Disable unused interfaces.
• Upgrade firmware to the latest version.
• Install physical devices in a restricted area.
• Place the FortiManager behind a firewall, such as a FortiGate, to limit attempts to access the FortiManager device.

When FortiManager is behind a FortiGate, AV and IPS features can be enabled on the FortiGate to further protect FortiManager from malware or intrusion attacks. See the FortiGate Administration Guide.

If the firewall in front of the FortiManager is NATing the traffic, configure the FortiManager with the dedicated public IP (see the Fortinet Knowledge Base article FD34605). This ensures that FortiGate devices are able to initiate communications (FGFM tunnels) to the FortiManager.

• Set up NTP. For example:

  config system ntp

  set status enable

  set sync_interval 60

  config ntpserver

  edit 1

  set server {<address_ipv4> | <fqdn_str>}

  end

  end

  end

• For audit purposes:
  • Use named accounts wherever possible.
  • Send logs to a central log destination, like FortiAnalyzer.

Do not lose the administrator log in information as there is no password recovery mechanism in FortiManager 5.4.0 and later.