Fortinet: Auditing Configs

Overview

This skill guides systematic security and consistency auditing of FortiGate .conf snapshots. Use it when the user asks to "audit", "review for issues", "check security", or "validate" one or more firewall configs.

See fortinet:read-configs for: how to locate and parse config sections, fleet inventory, file paths.

Audit Workflow

1. Determine scope: single site or all 10 sites
2. For each config section below, extract the relevant block using the read-configs approach
3. Check each item in the checklist
4. Collect all findings into a report grouped by severity
5. Present report (Critical first, then Warning, then Info)

Severity Definitions

Checklist

System Global (config system global)

System Interface (config system interface)

For each interface in the block:

Firewall Policies (config firewall policy)

For each policy (edit N ... next):

Router Static (config router static)

VPN IPsec Phase1 (config vpn ipsec phase1-interface)

For each tunnel:

VPN IPsec Phase2 (config vpn ipsec phase2-interface)

Known fleet issues to flag:

• CDW (cdwfw01) has proposal aes128-sha1 and dhgrp 2 on existing tunnels — these are existing Critical findings

Report Format

## Audit Report — {site(s)} — {date}

### Critical (N)
- **[SITE] [DOMAIN]** `config vpn ipsec phase1-interface / edit "EV-AWS-00"`
  Finding: `dhgrp 2` — DH group 2 (1024-bit) is cryptographically broken
  Remediation: `set dhgrp 14` (minimum) or `set dhgrp 19` for ECDH

### Warning (N)
- ...

### Info (N)
- ...

### Clean
- System lockout settings: all sites ✓
- ...

Always list what was checked and found clean, not just problems.

Multi-Site Audit

When auditing all 10 sites, consolidate:

• Group by finding type, list affected sites
• Example: "Telnet enabled — affects: cdw (1/10 sites)"
• Produce a summary matrix: rows = finding types, columns = sites, cells = ✓/✗