FortiGate firewalls sit on the internet edge with administrative interfaces, VPN portals and single sign-on paths that attackers have exploited again and again, and a single exposed management plane can hand over the network and every credential stored in the configuration. CISA's Known Exploited Vulnerabilities catalog lists 32 Fortinet entries, including SSL VPN flaws, super-admin authentication bypasses and, in 2026, a FortiCloud SSO bypass that let attackers create local admin accounts and download configurations. This guide sets out FortiOS-specific hardening: how admin identity works, how to lock down administrator access, API and integration accounts, logging, the baseline settings from Fortinet's own best practice guide, the retirement of SSL VPN tunnel mode in FortiOS 7.6.3, and how to think about firmware and configuration integrity after compromise. It is for network and security engineers who run FortiGate estates. For the general case of remote access appliances, see the VPN Security Guide; this page stays on FortiOS.
Key takeaways
- Never expose the admin interface to the internet. Remove HTTPS and SSH from WAN
allowaccess, and where remote management is unavoidable, use a local-in policy limited to trusted sources. - Every admin path needs controls, not just local accounts. FortiCloud SSO, REST API admins, remote RADIUS/LDAP admins and the console all reach super_admin if left open.
- SSL VPN tunnel mode is gone from FortiOS 7.6.3. Migrate FortiClient users to IPsec VPN before upgrading, and treat any remaining SSL VPN as legacy attack surface.
- Encrypt what the configuration stores. Enable
private-data-encryptionso stolen configurations do not yield usable secrets, and assume older backups are readable (CVE-2019-6693). - After exploitation, patching is not cleanup. Fortinet documented attacker persistence that survived patching and told customers to treat configuration as potentially compromised.
How identity and access work in FortiGate
| Admin path | How it authenticates | Known abuse | Control |
|---|---|---|---|
Local administrators (config system admin) | Password, optional FortiToken two-factor, trusted hosts | Brute force; attacker-created local admins as persistence | MFA, trusted hosts, lockout, renamed default admin |
| Remote administrators | RADIUS, LDAP or TACACS+ groups mapped to an admin profile | Stolen directory credentials; LDAP bind credentials exposed (CVE-2018-13374) | MFA at the server, least-privilege bind account, LDAPS or RADSEC |
| SSO administrators (SAML or FortiCloud SSO) | External identity provider | CVE-2025-59718 and CVE-2026-24858 FortiCloud SSO bypasses | Disable FortiCloud SSO login unless needed; SSO admins cannot use trusted hosts |
| REST API administrators | API key bound to an admin profile, with optional trusted hosts | Long-lived keys in scripts and automation platforms | Minimal profile, trusted hosts, vault storage, rotation |
| Fabric and management connections | Security Fabric, FortiManager and FortiAnalyzer trust | CVE-2025-24472 abused crafted CSF proxy requests for super-admin | Restrict fabric interfaces to management networks |
| Console | Physical serial access | Physical tampering | Physical security; admin-restrict-local options |
The configuration file is itself an identity store: it holds admin password hashes, LDAP and RADIUS secrets, IPsec pre-shared keys and certificates. Attackers who reach it can move into the directory and every VPN peer, which is why configuration theft features in Fortinet's 2026 SSO advisory.
Admin roles and privileged access
Lock down where admins connect from
- Interface access: on external interfaces,
unset allowaccess; on management interfaces,set allowaccess https sshonly. Fortinet recommends out-of-band management or access through a VPN. - Local-in policy: if management must be reachable externally, allow only trusted source addresses with a local-in policy, enable logging on it, and use ISDB or Geo-IP objects to narrow regions. Local-in policies can also carry virtual patching while you wait to upgrade.
- Trusted hosts: set
trusthost1totrusthost10on every local admin. Entries are evaluated in order, so put specific entries first. - Ports and TLS: change
admin-sportandadmin-ssh-portfrom defaults, setadmin-https-ssl-versions tlsv1-2(or higher where supported) andadmin-https-redirect enable.
Lock down who the admins are
- Named accounts: one account per person, mapped to an admin profile that limits what they can change. Reserve super_admin for a few named people and a sealed break-glass account.
- Rename the default admin: create a new super_admin, sign in with it, then rename
admin. - Two-factor: enable it per administrator with FortiToken, or at the RADIUS or SAML identity provider for remote admins. Keep a working super_admin before enabling, so you can recover.
- Lockout and timeouts:
admin-lockout-threshold(default 3, range 1 to 10) andadmin-lockout-duration(default 60 seconds; raise it, for example to 300);admintimeout 5; shorteradmin-ssh-grace-time. - Restrict local logins (7.6.0+): where remote authentication is reliable,
admin-restrict-local non-console-onlystops local accounts being used remotely while keeping console recovery. - FortiCloud SSO: registering a device to FortiCare in the GUI turns on "Allow administrative login using FortiCloud SSO" unless the toggle is cleared. If you do not use it,
set admin-forticloud-sso-login disableunderconfig system global. - Banners:
pre-login-bannerandpost-login-bannerfor legal notice.
See the Network Device Management Plane Hardening Guide for the vendor-neutral model.
Integrations, API tokens and service accounts
FortiGates are wired into directories, management platforms and automation, and each link is a non-human identity with a credential in the configuration.
| Integration | Credential | Hardening |
|---|---|---|
| LDAP user and admin authentication | Bind account and password | Least privilege bind account (Fortinet warns against full admin rights); LDAPS |
| RADIUS or TACACS+ | Shared secret | Long random secret per device; RADSEC (RADIUS over TLS) where supported |
| REST API automation | API key for an API admin | Read-only profile unless writes are needed; trusted hosts; key in a vault; rotate on staff or tool change |
| FortiManager and FortiAnalyzer | Fabric authorisation and serial trust | Patch them alongside FortiOS (the 2026 SSO bypass affected both); management network only |
| IPsec site-to-site | Pre-shared keys or certificates | Certificates over pre-shared keys; strong proposals; rotate keys after any configuration exposure |
| SNMP and NTP | Community strings, NTP keys | SNMPv3 with authentication and privacy; NTP authentication |
Protect secrets stored in the configuration
- Private data encryption:
set private-data-encryption enableunderconfig system global. On 7.6.0 you supply a 32 hexadecimal digit key; from 7.6.1 FortiGate generates a random key, and a TPM is used on models that have one. From 7.6.1 admin passwords are stored with PBKDF2. - Backups: encrypt configuration backups, mask passwords when sharing them, store them securely and delete old copies. A backup made with private data encryption cannot be restored under a different key, and before an RMA you must disable it and back up again.
- Legacy exposure: CVE-2019-6693 (in KEV, ransomware use known) concerns a hard-coded key used to cipher sensitive data in configuration backups, so treat older backups as readable by attackers and rotate the secrets they contain.
Logging and detection
Send logs off the device to FortiAnalyzer or a SIEM over an encrypted transport (Fortinet recommends encrypted logging rather than plain TCP), because an attacker with admin rights can change local logging. See the Network Device Syslog and Configuration Change Detection Guide.
| Event | Why it matters | ATT&CK |
|---|---|---|
| Admin login success from a new source, SSO login, or login outside change windows | Stolen credentials or SSO bypass | T1078 Valid Accounts |
| Bursts of admin or VPN login failures, lockouts | Brute force and spraying | T1110 Brute Force |
| New local admin account or admin profile change | Persistence seen in the 2026 FortiCloud SSO campaign | T1136.001 Local Account |
| Configuration download or backup by an admin | Credential and topology theft | T1602 Data from Configuration Repository |
| Changes to admin authentication, SSO or remote auth servers | Authentication tampering | T1556.004 Network Device Authentication |
| Crashes or restarts of VPN or web management daemons | Possible exploitation of memory corruption flaws | T1190 Exploit Public-Facing Application |
Firewall policy, local-in policy or allowaccess changes | Opening the management plane | T1133 External Remote Services |
Metrics
- Exposed management: FortiGates with HTTPS or SSH admin reachable from the internet (target zero), checked from an external scan.
- Patch latency: days from a Fortinet PSIRT advisory for a KEV-listed flaw to deployment.
- MFA coverage: share of admin accounts, local and remote, enforced with two-factor.
- Admin account drift: local admin accounts not in the approved list, per device.
- SSL VPN remaining: devices still running SSL VPN tunnel or web mode.
- Log coverage: devices sending admin and system events to the central platform.
Hardening baseline
| Area | Setting (from Fortinet's 7.6 best practices) |
|---|---|
| Cryptography | strong-crypto enable, ssl-static-key-ciphers disable, dh-params 8192 |
| Secure storage | private-data-encryption enable; encrypted backups |
| Physical | config system auto-install with auto-install-config disable and auto-install-image disable where USB access is possible; 802.1X on ports |
| Protocols | LDAPS, RADSEC, SNMPv3, SSH, SCP; OSPF MD5 and NTP authentication; encrypted logging |
| Admin access | Non-default ports and username; no admin on WAN; local-in policy with trusted hosts and logging |
| Firmware | Latest patch release of a supported branch; never past End of Support; federated update along the upgrade path |
| Threat protection | Current FortiGuard AV and IPS databases; DoS policy anomalies (tcp_syn_flood, tcp_port_scan and session anomalies) in monitor mode until thresholds are tuned |
SSL VPN retirement
Fortinet's technical note states that from FortiOS 7.6.3 SSL VPN tunnel mode is removed on all models and its configuration is not kept on upgrade, so tunnel users lose access. Web mode survives as Agentless VPN only on larger models; some smaller F-series and G-series models lost SSL VPN entirely from 7.6.0 or earlier. Replacements are IPsec VPN for FortiClient users, Agentless VPN, or ZTNA agentless web access (from 7.6.1).
- Find devices with
show vpn ssl settingsand list SSL VPN users and portals. - Build the IPsec remote access configuration with MFA and certificate-based device checks, and pilot with IT staff.
- Move user groups in waves, keeping SSL VPN available only to unmigrated groups.
- Disable SSL VPN on each device once its users are migrated, then upgrade to 7.6.3 or later.
- Rollback: keep the SSL VPN configuration in a backup until the IPsec service has run through a full business cycle, but do not upgrade past 7.6.2 until migration is complete, because the upgrade removes tunnel mode.
See the IPsec Security Guide and the ZTNA Guide.
Firmware and configuration integrity
Fortinet's April 2025 analysis described an attacker who, after exploiting older SSL VPN flaws, planted a symbolic link in the folder serving SSL VPN language files, giving read-only access to the root filesystem, including configurations, that persisted after patching. Fortinet's fixes (7.6.2, 7.4.7, 7.2.11, 7.0.17 and 6.4.16) remove the link, an AV/IPS signature removes it on older branches, and Fortinet's advice was to "treat all configuration as potentially compromised".
- Install only verified images: download firmware from Fortinet support, check the published checksum, and use federated upgrade rather than ad hoc images.
- After a suspected compromise: follow Fortinet's recovery guidance, upgrade, review every admin account, rebuild from a known-good configuration rather than the live one, and rotate every secret the configuration held (admin passwords, LDAP and RADIUS secrets, IPsec keys, certificates). See the Edge Device Compromise Investigation Playbook.
Decision guidance
- Small estate: no WAN admin, MFA on all admins, FortiCloud SSO off unless used, automatic patch updates on standalone units, and logs to one central platform.
- Large estate: manage through FortiManager on a dedicated management network, remote admin authentication with MFA, REST API keys from a vault, federated upgrades, and external attack surface scanning.
- Keep or replace SSL VPN: replace. IPsec or ZTNA is the supported path, and SSL VPN has been the most exploited FortiOS component.
Common misconfigurations
- HTTPS admin on the WAN interface, sometimes on a non-standard port that is still scanned. Several super-admin authentication bypasses (CVE-2024-55591, CVE-2025-24472) needed only that reach.
- FortiCloud SSO left on after FortiCare registration, which made devices reachable through CVE-2026-24858.
- Running past End of Support or several patch levels behind on a KEV-listed branch.
- Shared admin accounts without MFA, so attacker-created admins blend in and no one can say which logins were legitimate.
- Patching after exploitation without rebuilding, leaving persistence and stolen secrets in place.
- Over-privileged LDAP bind accounts in the configuration, turning a firewall compromise into a directory compromise; CVE-2018-13374 exposed exactly these LDAP login credentials.
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ATT&CK |
|---|---|---|---|
| Patching and supported firmware | PR.PS-02, ID.RA-01 | SI-2 | T1190 |
| Management plane restriction | PR.IR-01 | AC-17, SC-7, CM-7 | T1133 |
| Admin MFA, lockout, least privilege | PR.AA-05 | IA-2(1), AC-7, AC-6 | T1078, T1110 |
| Stored secrets and encrypted protocols | PR.DS-01, PR.DS-02 | SC-8, SC-28, IA-5 | T1602 |
| Firmware and configuration integrity | PR.PS-01 | SI-7, CM-6 | T1556.004 |
| Central logging | DE.CM-01 | AU-6, AU-9 | T1136.001 |
Practitioner checklist
- Remove admin access from every internet-facing interface and confirm with an external scan.
- Set trusted hosts on every local admin and a logged local-in policy for any remote management.
- Enforce two-factor for all admins and rename the default admin account.
- Disable FortiCloud SSO admin login unless it is in active, monitored use.
- Apply the cryptography, private data encryption and auto-install settings from Fortinet's best practices.
- Patch KEV-listed Fortinet flaws within your edge device window and never run past End of Support.
- Migrate SSL VPN users to IPsec, Agentless VPN or ZTNA before moving to FortiOS 7.6.3.
- Scope LDAP, RADIUS and API accounts to least privilege and keep their secrets in a vault.
- Forward admin, configuration and system events off-box and alert on new admins and config downloads.
- After any suspected compromise, rebuild from known-good configuration and rotate every stored secret.
Standards and references
- Fortinet: FortiOS 7.6 Best Practices, Hardening
- Fortinet PSIRT: FG-IR-26-060 Administrative FortiCloud SSO authentication bypass
- Fortinet PSIRT blog: Analysis of threat actor activity
- Fortinet Community: SSL VPN support on FortiGate models
- Fortinet Community: System administrator best practices for FortiGate and FortiProxy
- CISA: Known Exploited Vulnerabilities Catalog
- MITRE ATT&CK: Network Device Authentication
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: VPN Security Guide · Edge Device Security Guide · Vulnerability Management for Network Devices Guide · Palo Alto Networks PAN-OS Hardening Guide · Firewall Management Guide