Skip to content
ConfigProof

All controls

FGT-SEC-023MediumFortiGateCIS 6.1.2

SSL VPN open to every source or below TLS 1.2

At a glance

Base severity

Medium

Area

Remote access VPN

Platform

FortiGate

Evidence level

Derived0.90

Benchmark reference

CIS 6.1.2

Reads the export, not the device

ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.

Why it matters

The SSL VPN portal is an internet-facing login page, and FortiOS SSL VPN has been attacked repeatedly. Open to every source address, and above all with an old minimum TLS version, it is exposed to the widest audience.

How to fix it

Web interface

The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.

  1. Restrict source-address under config vpn ssl settings to the networks users connect from, where that is possible.
  2. Set ssl-min-proto-ver tls1-2.

Command line

FortiOS CLI

config vpn ssl settingsset ssl-min-proto-ver tls1-2set source-address <source-address>end

An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. FortiOS saves a change when you type next or end, with no separate commit. Read every line first.

Read it back

show vpn ssl settings
Values to fill in1
<source-address>
The address objects allowed as the source
Before you type it2
  • Written from the FortiOS CLI Reference, not yet run on a device. Read each line before typing it.
  • On a device with VDOMs, type these inside the VDOM (config vdom, edit the VDOM) or inside config global for a global setting.

How to confirm the fix

  • Connect from an allowed network and from one outside it after the change.

Limits

  • A setting the backup does not write is read as FortiOS's documented default for the device's release.

Compliance references

6.1.2

CIS FortiGate 7.4.x Benchmark v1.0.1

Covers part of the recommendation

Where a control aligns with a recommendation of the CIS FortiGate 7.4.x Benchmark v1.0.1, that recommendation is cited as a reference. Only that version was checked. A reference is not a certification.

More in Remote access VPN

See it on your own firewall

One complete analysis of one firewall costs nothing. A card is required and nothing is charged.

Start a free analysis