CMMC Compliance with FortiGate Firewalls – Part 2

In CMMC Compliance with FortiGate Firewalls – Part 1, we discussed CMMC compliance, FIPS, and how to obtain certified FIPS firmware from Fortinet.  In this article we will discuss how to enable FIPS mode on the firewall and do the initial configuration. 

It is important to note that FIPS-CC mode can be enabled on all FortiOS versions (which enables FIPS-compliant behavior), but only a subset of firmware is certified for FIPS-CC. Even when using certified builds, FIPS-CC mode is disabled by default after installing the firmware. Additionally, FIPS-CC mode can only be activated/configured using a serial console connection. 

Steps to enable FIPS-CC mode: 

1. Log in to the CLI through the console port. Use the default admin account or another account with the superadmin access profile. 

Enter the following commands: 

show full-configuration 
config system fips-cc 
set status enable 
set entropy-token enable 
end 
end 

2. After that, a prompt will appear asking to set a new administrator password for the “admin” account. 

Please enter admin administrator password: 
New password must conform to the password policy enforced on this device: 
minimum-length=8; must contain upper-case-letter lower-case-letter number non-alphanumeric 

3. After that, the CLI displays the following message warning:  

Warning: most configuration will be lost, do you want to continue? (y/n)  

4. Type Y, then hit Enter to confirm. The FortiGate will restart and will run in FIPS-CC mode afterward. 

5. Once rebooted, all network interfaces have been disabled.  It is necessary to bring each interface up from the CLI and enable admin access as necessary. 

config system interface 
edit internal
set status up 
set ip <ip_address> <netmask>  
set allowaccess ping https 
end 

After the LAN or internal interface is active and https is allowed, management and configuration can be done from the Web UI.  On a side note, with FIPS mode enabled, firewall rules, security profiles, and other settings are disable by default and need to be configured from scratch. 

If you have any other questions about CMMC compliance, FIPS mode, or FortiGate firewalls please contact Sikich. You can also check out the following references from the FortiGate community:

• https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-FIPS-CC-mode/ta-p/196629
• https://community.fortinet.com/t5/FortiGate/Technical-Tip-Getting-Started-with-FIPS-CC-enabled/ta-p/270426